Knowing what every device in the house talks to
Problem
A house full of devices, each free to talk to anything, and no way to say which of them reached where. The usual answer is a cloud service that inspects the traffic, which hands the one record worth protecting to a third party.
Action
Two sources joined per device: the house resolver's query log, and flow records exported by the router for what DNS never sees. Every destination no DNS answer explains is attributed to the network that operates it, and a digest of each run goes to a language model running on my own hardware. It flags what looks wrong and pushes it to a phone.
Outcome
5.3 million flow records in 18 days, over 1,000 analysis runs. Roughly one destination in eight has no DNS answer behind it, and each of those now arrives with the network that announces it rather than as a bare address. No traffic record leaves the house to be judged.
The detail worth keeping: "unexplained" and "unknown" are not the same thing. Apps that pin their server addresses never ask DNS at all, so that share is a floor, not a backlog. Handed a bare address and a count, the model read volume as intent and flagged a messaging app as possible command and control. Giving it the address's owner, not a bigger DNS window, is what stopped the false alarms.
Discuss your project
Email me with what your system does, what is failing or missing, and your timeline.
Limited slots, and a short discovery call to confirm fit, scope and timelines before anything is agreed.