Internet of things security appliance

A computer system for an Internet of Things security appliance, the computer system comprising:

• one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage medium, and program instructions stored on at least one of the one or more tangible storage medium for execution by at least one of the one or more processors via at least one of the one or more memories, wherein the computer system is capable of performing a method comprising:
• intercepting a data packet sent from a server to a client computing device;
• performing a security check on the received data packet using a plurality of security modules;
• determining the received data packet is not malicious based on the performed security check;
• determining a shadow tester to test the determined data packet based on a type associated with the client computing device and based on determining the received data packet is not malicious;
• creating a virtualization environment of the client computing device using the determined shadow tester and a virtualization module;
• analyzing a plurality of behaviors associated with the determined data packet within the created virtualization environment using a plurality of detection modules;
• determining the analyzed plurality of behaviors do not violate a behavior policy associated with the client computing device;
• and
• transmitting the determined data packet to the client computing device based on determining the analyzed plurality of behaviors do not violate the behavior policy.

A computer program product for an Internet of Things security appliance, the computer program product comprising:

• one or more computer-readable tangible storage medium and program instructions stored on at least one of the one or more tangible storage medium, the program instructions executable by a processor, the program instructions comprising:
• program instructions to intercept a data packet sent from a server to a client computing device;
• program instructions to perform a security check on the received data packet using a plurality of security modules;
• program instructions to determine the received data packet is not malicious based on the performed security check;
• program instructions to determine a shadow tester to test the determined data packet based on a type associated with the client computing device and based on determining the received data packet is not malicious;
• program instructions to create a virtualization environment of the client computing device using the determined shadow tester and a virtualization module;
• program instructions to analyze a plurality of behaviors associated with the determined data packet within the created virtualization environment using a plurality of detection modules;
• program instructions to determine the analyzed plurality of behaviors do not violate a behavior policy associated with the client computing device;
• and
• program instructions to transmit the determined data packet to the client computing device based on determining the analyzed plurality of behaviors do not violate the behavior policy.