With the increased security risks against IoT based smart homes, many security appliances have been commercialized. These appliances or boxes claim to protect the home network from malware, cyber-attacks, and preserve consumer’s data privacy.

There is a growing list of entrants in this space, including F-Secure (SENSE), BitDefender BOX, and many others.

I would like to know how these boxes work, technically. Is there an open source among them?

Do they simply work like traditional IDS/IPS/Firewall? I am sure there are many differences and the cloud support is one of them. Are there other differences?

  • I'm not sure this is really a IoT question. It would probably be better suited to one of the network specific groups
    – hardillb
    Jan 8, 2018 at 16:18
  • 4
    thanks @hardillb, but I do believe that this question is very specific to IoT, because particularities of IoT networks have motivated security researchers to rethink and rebuild new and more intelligent perimeter security solutions
    – BiG_TooTh
    Jan 8, 2018 at 17:30
  • anyway.. if i didn't get an answer here, how do I do ? is there a way to link this question directly to the 'Information Security' group, or I just re-ask it there .. can I do that ?
    – BiG_TooTh
    Jan 8, 2018 at 17:32
  • The moderators can move it if they think it's suitable or they will just delete it and you can ask on the correct site. I still think this is off topic because you are asking how these IDS systems work, which is very specifically a networking question.
    – hardillb
    Jan 8, 2018 at 20:20
  • 1
    Many questions are valid on more than one site at a time - I think this is fine here as a general catch-all for this type of product (effectively a definition) rather than the in-depth operational specifics that might be covered on Information Security.. Jan 9, 2018 at 10:13

1 Answer 1


The boxes are Intrusion Prevention Systems (IPSs) that work by monitoring for "Indicators of Compromise" (IoC). This would be network traffic that is unexpected in your environment; network traffic that goes to a known bad destination; or network traffic that contains packets consistent with malware.

Typically, these boxes come with a subscription. The company selling them sends out frequent updates (daily or more often) that refresh the IoC database. If they discover that some ransomware reaches out to https://ransom.keyserver.evil.example.com, they might immediately add the network address to the IPS blacklist, and publish it to their customers as soon as they can. If you have a device on your network that tries to connect to get a ransomware key, their IPS will break the connection so you don't get infected.

Some of these boxes also come with software that maintains an inventory of your devices. You can take a look at all of the little IoT things on your network today, and bless them all. Tomorrow, if it detects there's a new node on your network, it can pop up a warning on your mobile phone that says "New thing detected on your network, authorize (yes/no)?" This might help you block someone borrowing your wifi, or hacking into your network.

There isn't a direct open source replacement for all of these functions; not because the technology is so special, but because the constant updating of the IoC database requires intel constantly gathered by humans responding to new incidents, and paying a bunch of humans is expensive. You can achieve some of this functionality with an open source IPS system like Snort, but the Snort "community" subscription is updated 30 days after their commercial subscription. That's quite slow when today's common threats include 0-day based malware.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.