A method for detecting malicious behavior based on network communications establishing an encrypted connection between a smart appliance and a remote server, comprising: intercepting, by a network traffic hub in a local network, a first network communication from a smart appliance in the local network, for transmission to a remote server in a wide area network, the first network communication comprising an encryption suite that comprises one or more encryption algorithms the smart appliance uses to encrypt network traffic with the remote server; extracting the encryption suite from the first network communication; transmitting, by the network traffic hub, the first network communication to the remote server; intercepting, by the network traffic hub, one or more second network communications from the remote server to the smart appliance, the one or more second network communications comprising a public certificate associated with the remote server and an identified subset of the one or more encryption algorithms; extracting the public certificate and the identified subset of the one or more encryption algorithms from the one or more second network communications; transmitting, by the network traffic hub, the one or more second network communications to the smart appliance; detecting malicious behavior performed by the smart appliance or remote server, based on the encryption suite, public certificate, and the identified subset of the one or more encryption algorithms; and blocking network communications between the smart appliance and the remote server, responsive to detecting malicious behavior in the network communications between the smart appliance and the remote server by the network traffic hub. intercepting, by a network traffic hub in a local network, a first network communication from a smart appliance in the local network, for transmission to a remote server in a wide area network, the first network communication comprising an encryption suite that comprises one or more encryption algorithms the smart appliance uses to encrypt network traffic with the remote server; extracting the encryption suite from the first network communication; transmitting, by the network traffic hub, the first network communication to the remote server; intercepting, by the network traffic hub, one or more second network communications from the remote server to the smart appliance, the one or more second network communications comprising a public certificate associated with the remote server and an identified subset of the one or more encryption algorithms; extracting the public certificate and the identified subset of the one or more encryption algorithms from the one or more second network communications; transmitting, by the network traffic hub, the one or more second network communications to the smart appliance; detecting malicious behavior performed by the smart appliance or remote server, based on the encryption suite, public certificate, and the identified subset of the one or more encryption algorithms; and blocking network communications between the smart appliance and the remote server, responsive to detecting malicious behavior in the network communications between the smart appliance and the remote server by the network traffic hub.