Method and device for robust detection, analytics, and filtering of data/information exchange with connected user devices in a gateway-connected user-space

A system that enhances at-home security of network connected devices, the system comprising:

• a security appliance having at least one port for establishing a seamless communication interface with a connected gateway of a local network, the security appliance configured to:
• monitor network traffic coming into and going out from the connected gateway;
• identify traffic anomalies within the monitored traffic;
• and block and filter out undesirable traffic associated with the anomalies in both inbound and outbound communications utilizing a local evaluation module;
• and generate one or more alerts and update a remote server database;
• and
• a management server communicatively connected to the security appliance via a public network, the server having a server processor communicatively coupled to the remote server database and server firmware that executes on the processor to cause the server to:
• receive data from a plurality of different security appliances, each associated with a specific local network to which a respective appliance is connected;
• analyze the received data for potential harm to one of the local network, a user device, and an enterprise network to which the user device connects;
• and
• generate a report that consolidates a result of analyzing the data, the report sanitized of all personal and private data of users, including patterns of use and connection of the device.

A device-implemented method comprising:

• interfacing, via a security appliance, with a local user network device that supports external/public network connectivity and information communication by one or more user devices;
• detecting anomalies within a behavior associated with Internet usage through machine learning algorithms;
• generating and forwarding configurable push alerts for security issues identified by the appliance;
• blocking and filtering out unwanted and undesirable traffic associated with the anomalies in both inbound and outbound communications;
• generating one or more alerts and filtering out the captured data in preparation for forwarding to a remote server database;
• forwarding the filtered information about the identified traffic anomalies to a centralized database for evaluation and reporting;
• and
• in response to receiving an update from a server associated with the centralized database, update a security protocol of at least one of the appliance and the gateway to more quickly respond to detection of similar traffic anomalies and mitigate or counter emerging threats associated with the traffic anomalies.