A computer program product comprising a non-transitory computer-readable storage medium comprising instructions encoded thereon that, when executed by a processor, cause the processor to: receive, at a network traffic hub, network traffic data from one or more smart appliances communicatively coupled to a local network, wherein the network traffic data is sent in the local network; extract appliance traffic data from the network traffic data, the appliance traffic data comprising one or more internet addresses each corresponding to one of the one or more smart appliances and traffic bandwidth associated with the network traffic sent in the local network; extract appliance identification data from the network traffic data, the appliance identification data comprising one or more fields extracted from the network traffic data; transmit the appliance traffic data and the appliance identification data to a behavior analysis engine; receive traffic control instructions from the behavior analysis engine, the traffic control instructions identifying a smart appliance of the one or more smart appliances and including a numeric confidence value representative of a probability that the identified smart appliance includes malicious code; in response to the numeric confidence value being greater than a first threshold, block subsequent traffic to and from the identified smart appliance; in response to the numeric confidence value being less than the first threshold but greater than a second threshold, add the identified smart appliance to a security watchlist and allow subsequent traffic to and from the identified smart appliance; and in response to the numeric confidence value being less than the second threshold, allow subsequent traffic to and from the identified smart appliance. receive, at a network traffic hub, network traffic data from one or more smart appliances communicatively coupled to a local network, wherein the network traffic data is sent in the local network; extract appliance traffic data from the network traffic data, the appliance traffic data comprising one or more internet addresses each corresponding to one of the one or more smart appliances and traffic bandwidth associated with the network traffic sent in the local network; extract appliance identification data from the network traffic data, the appliance identification data comprising one or more fields extracted from the network traffic data; transmit the appliance traffic data and the appliance identification data to a behavior analysis engine; receive traffic control instructions from the behavior analysis engine, the traffic control instructions identifying a smart appliance of the one or more smart appliances and including a numeric confidence value representative of a probability that the identified smart appliance includes malicious code; in response to the numeric confidence value being greater than a first threshold, block subsequent traffic to and from the identified smart appliance; in response to the numeric confidence value being less than the first threshold but greater than a second threshold, add the identified smart appliance to a security watchlist and allow subsequent traffic to and from the identified smart appliance; and in response to the numeric confidence value being less than the second threshold, allow subsequent traffic to and from the identified smart appliance.