AI-Augmented Anomaly Analytics from Packet Traces and Host Events in Residential Device HubsAI-Augmented Anomaly Analytics from Packet Traces and Host Events in Residential Device Hubs
Main article
Abstract
Residential device hubs increasingly mediate the traffic and local execution context of cameras, locks, speakers, thermostats, appliance bridges, and mobile companion applications. Although these hubs provide convenience, they also concentrate risk: one compromised hub can hide malicious activity behind encrypted cloud traffic, reshape device discovery, or suppress local security events. This paper proposes an AI-augmented anomaly analytics framework that fuses packet traces with host events to support practical detection and investigation in residential device-hub environments. The framework aligns flow-level network behavior with process, firmware, authentication, and resource events, then uses temporal representation learning, calibrated novelty scoring, and explanation layers to produce analyst-readable alerts. A controlled benchmark of 32 days, 86 residential devices, 12.9 million flows, and 2.3 million host events is used to evaluate five model configurations. Compared with a flow-only autoencoder baseline, the proposed hybrid multimodal model improves F1 score from 0.842 to 0.941, reduces false positives from 5.8 to 2.1 per hub-day, and shortens median triage time from 14.6 to 6.8 minutes. The results show that the largest gains come not from deeper models alone but from time alignment, device-type context, uncertainty-aware thresholds, and explanations that reveal why packet and host evidence jointly indicate suspicious behavior. The study contributes a deployment-oriented architecture, a feature and evaluation protocol, and design recommendations for privacy-aware anomaly analytics in home and small-office hubs.
