A host system-on-chip (SoC) includes a network on chip (NoC) for transmitting local traffic between internal blocks of the SoC, an external processor link for receiving messages at the host SoC from an untrusted device. A traffic controller in the host SoC that is coupled with the external processor link monitors an amount of external traffic from the untrusted device over a set of one or more time intervals, detects a violation of a traffic policy based on the amount of external traffic, and in response to detecting the violation, reduces traffic in the NoC resulting from the messages from the untrusted device.