Abstract: Network vulnerability is predicted for a user's network-connected smart device, wherein the user's network-connected smart device has one or more device classifications. A memory stores a plurality of crowdsourced vulnerability profiles generated from individual vulnerability profiles of a plurality of network-connected smart devices, and anomalous behavior associated with each of the respective crowdsourced vulnerability profiles. Each crowdsourced vulnerability profile is generated from individual vulnerability profiles of a plurality of network-connected smart devices having one of the same device classifications, and each of the individual vulnerability profiles are created from network scans for the respective network-connected smart device. A vulnerability profile is generated of the user's network-connected smart device.

Abstract: One or more services are identified for a user's network-connected smart device by generating a smart device fingerprint for the network-connected smart device, electronically communicating the smart device fingerprint for the network-connected smart device to a processor, and analyzing the data in the smart device fingerprint for the network-connected smart device in the processor and identifying one or more services based on the data in the smart device fingerprint for the network-connected smart device. The smart device fingerprint including at least device metadata of the network-connected smart device, a vulnerability profile of the network-connected smart device, and anomaly and/or behavior metadata of the network-connected smart device.

Abstract: Anomalies are detected in network packet header data associated with a user's smart device that is in communication with one or more external sources via an electronic network. The user's smart device has one or more device classifications. Bayesian priors are stored of network traffic obtained from crowdsourced network packet header data for a plurality of smart devices having one of the same device classifications as the user's smart device. Network traffic obtained from network packet header data for the user's smart device is captured. The network traffic for the user's smart device is compared with the Bayesian priors and any anomalies are identified. The anomalies indicate potential abnormal data communication behavior regarding the user's smart device.

Abstract: A method is provided for performing selective inspection of network traffic associated with a plurality of network-connected smart devices using a Man-In-The-Middle (MITM) gateway. The MITM gateway operate in a first mode or a second mode for each of the network-connected smart devices. The first mode configures the MITM gateway to perform inspection of network traffic associated with the respective network-connected smart device, and the second mode configures the MITM gateway to not perform any inspection of network traffic associated with the respective network-connected smart device. The MITM gateway is changed to operate in the second mode for a respective network-connected smart device when it is detected that the MITM gateway operating in the first mode is adversely affecting the operation of the respective network-connected smart device.