| CPC H04L 63/1425 (2013.01) [H04L 43/062 (2013.01); H04L 63/0263 (2013.01)] | 20 Claims |

|
1. A method comprising:
monitoring, by a processing system including at least one processor, network traffic flowing into and out of a home network that is connected to a core network of a telecommunications network via a gateway device;
constructing, by the processing system, a model of the network traffic flowing into and out of the home network, based on the monitoring;
detecting, by the processing system, an anomaly in the model of the network traffic;
generating, by the processing system, a rule based on the anomaly, where the rule specifies an action to be taken when a match condition related to the anomaly is detected; and
deploying, by the processing system, the rule on the gateway device.
|