In one example, the present disclosure describes a device, computer-readable medium, and method for implementing programmable security specifications in home routers. For instance, in one example, a method performed by a processing system including at least one processor includes monitoring network traffic flowing into and out of a home network that is connected to a core network via a gateway device, constructing a model of network traffic flowing into and out of the home network, based on the monitoring, detecting an anomaly in the model of the network traffic, generating a rule based on the anomaly, where the rule specifies an action to be taken when a match condition related to the anomaly is detected, and deploying the rule on the gateway device.