Correlation-based network security

Abstract

A correlation-based network security for network devices is disclosed. Correlations between multiple network devices are mapped based on telemetry data from the multiple network devices to determine correlated devices. Behaviors of the correlated devices are monitored based on telemetry data received from the correlated devices to determine abnormal devices among the multiple devices. Priority alerts are generated for multiple network devices based on security alerts received for the abnormal devices.

Description

Background Art

[0001] In general, the Internet of Things or IoT is a system of interconnected computing devices, mechanical and digital machines, objects, animals, or people that are provided with unique identifiers and the ability to transmit data over a network without human-to-human or human-to-computer interaction. IoT is an example of a network device coupled to a computer network, where the network device can send or receive data on the computer network. In one example, the network device may include a sensor for collecting information and a communication circuit for sending information, and examples may include temperature sensors, motion sensors, and humidity sensors. In another example, the network device may include a communication circuit for receiving information and a circuit for performing tasks related to the received information, and examples may include a 3D printer and a smart light bulb. In yet another example, the network device may include: a circuit including the ability to send and receive information and a circuit for collecting information and a circuit for operating on the received information, and examples may include a smart speaker that can receive commands via a microphone and play music via an output speaker. Network devices extend the capabilities of computer networks beyond general computing devices, including laptops and smartphones, and allow detection and control of various processes and environments on a computer network. Summary of the invention

[0002] This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0003] The present disclosure relates to correlation-based network security for network devices such as IoT devices and systems. A network environment may include hundreds of thousands or millions of IoT devices, and this scale introduces new security challenges to security systems and exacerbates existing security issues, such as generating a large amount of noise. A correlation monitoring service can operate with existing security services to address noise issues and prioritize alarms. In one example, correlations between multiple network devices are mapped based on telemetry data from multiple network devices to determine related devices. For example, a correlation monitoring service collects telemetry data from network devices and back-end services in a network environment. An association between devices is established and correlations are mapped, which may include expected telemetry data of a correlation-mapped network device, which is based on actual telemetry data of another network device mapped by correlation. The behavior of related devices is monitored based on telemetry data received from related devices to determine abnormal devices among multiple devices. Behavior can be detected inferentially based on telemetry data. Priority alarms for multiple network devices are generated based on security alarms received for abnormal devices. A correlation monitoring service can be used with a security service to determine security alarms involving online operations of network devices.

[0004] The correlation-based network security and correlation monitoring service can be implemented as a method, a computer-readable medium or a computer-readable storage device having an executable instruction set for controlling a processor to perform the method, or a system including a processor and a memory, such as a computing device. In one example, the correlation monitoring service can be applied as part of an infrastructure or platform as a service, such as for a network environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated in and constitute a part of the present disclosure. The accompanying drawings illustrate the embodiments and are used together with the specification to explain the principles of the embodiments. Other embodiments and many expected advantages of the embodiments will be easily appreciated as they become better understood by reference to the following description. The elements of the accompanying drawings are not necessarily to scale with respect to each other. The same reference numerals indicate corresponding similar parts.

[0006] Figure 1 is a block diagram illustrating examples of computing devices that may be configured in a computer network to provide, for example, a cloud computing environment.

[0007] Figure 2 is a schematic diagram illustrating an example network environment that includes a dependency monitoring service.

[0008] Figure 3 is a block diagram illustrating an example method, such as Figure 2 A method for monitoring services for dependencies.

[0009] Figure 4 is a block diagram illustrating an example method, such as Figure 2 Methods and Figure 3 characteristics of the method.

[0010] Figure 5 is a block diagram illustrating an example method, such as Figure 2 Methods and Figure 3 characteristics of the method. DETAILED DESCRIPTION

[0011] In the following description, reference is made to the accompanying drawings, which form a part of the description, and in which are shown by way of illustration specific embodiments in which the present invention may be practiced. It should be understood that other embodiments may be utilized and structural or logical changes may be made without departing from the scope of the present invention. Therefore, the following description should not be construed as limiting. It should be understood that, unless otherwise specifically noted, the features of the various example embodiments described herein may be combined with each other in part or in whole.

[0012] Figure 1 An exemplary computer system is illustrated that can be employed in an operating environment and used to host or run a computer application included on one or more computer-readable storage media that stores computer-executable instructions for controlling a computer system such as a computing device to perform a process. The exemplary computer system includes a computing device, such as computing device 100. Computing device 100 can take one or more of several forms. Such forms include tablet computers, personal computers, workstations, servers, handheld devices, consumer electronic devices (such as video game consoles or digital video recorders), or others, and can be a stand-alone device or configured as part of a computer network.

[0013] In a basic hardware configuration, the computing device 100 typically includes a processor system (i.e., a processor 102) having one or more processing units and a memory 104. For example, the processing unit may include two or more processing cores on a chip or two or more processor chips. In some examples, the computing device may also have one or more additional processing or special-purpose processors (not shown), such as a graphics processor for general-purpose computing on a graphics processor unit, to perform processing functions unloaded from the processor 102. The memory 104 may be arranged in a hierarchy and may include one or more levels of cache. Depending on the configuration and type of the computing device, the memory 104 may be volatile (such as random access memory (RAM)), non-volatile (such as read-only memory (ROM), flash memory, etc.), or some combination of the two.

[0014] The computing device 100 may also have additional features or functionalities. For example, the computing device 100 may also include additional storage devices. Such storage devices may be removable or non-removable and may include magnetic or optical disks, solid-state memory, or flash memory devices, such as the removable storage device 108 and the non-removable storage device 110. Computer storage media include volatile and non-volatile, removable and non-removable storage media implemented in any suitable method or technology for storing information, such as computer-readable instructions, data structures, program modules, or other data. The memory 104, the removable storage device 108, and the non-removable storage device 110 are all examples of computer storage media. Computer storage media include RAM, ROM, EEPROM, flash memory or other storage technology, CD-ROM, digital versatile disc (DVD) or other optical storage devices, magnetic cassettes, magnetic tapes, magnetic disk storage devices or other magnetic storage devices, universal serial bus (USB) flash drives, flash memory cards or other flash memory devices, or any other storage media that can be used to store desired information and can be accessed by the computing device 100. Therefore, the propagation signal itself does not meet the conditions of being a storage medium. Any such computer storage media may be part of computing device 100 .

[0015] The computing device 100 often includes one or more input and / or output connections, such as USB connections, display ports, proprietary connections, and other connections to various devices to provide input and output to the computing device. Input devices 112 may include devices such as keyboards, pointing devices (e.g., mice, trackpads), styluses, voice input devices, touch input devices (e.g., touch screens), and the like. Output devices 111 may include devices such as displays, speakers, printers, and the like.

[0016] The computing device 100 often includes one or more communication connections 114 that allow the computing device 100 to communicate with other computers / applications 115. Example communication connections may include Ethernet interfaces, wireless interfaces, bus interfaces, storage area network interfaces, and proprietary interfaces. The communication connections may be used to couple the computing device 100 to a computer network, which may be classified according to a variety of characteristics such as topology, connection method, and scale. A network is a collection of computing devices and possibly other devices interconnected by communication channels that facilitate communication and allow sharing of resources and information between interconnected devices. Examples of computer networks include local area networks, wide area networks, the Internet, or other networks.

[0017] In one example, one or more computing devices 100 may be configured as servers in a data center to provide distributed computing services, such as cloud computing services. The data center may provide pooled resources on which customers or tenants can dynamically supply and scale applications as needed without adding servers or additional networking. The data center may be configured to communicate with local computing devices used by cloud consumers, including personal computers, mobile devices, embedded systems, or other computing devices. Within the data center, the computing device 100 may be configured as a server, or as a standalone device, or as an individual blade in a rack of one or more other server devices. One or more host processors on each server, such as processor 102, and other components including memory 104 and storage device 110, run a host operating system that can support multiple virtual machines on each server. A tenant may initially use one virtual machine on a server to run an application. When demand increases, the data center may activate additional virtual machines on a server or other servers, and when demand decreases, the data center may deactivate the virtual machine.

[0018] A data center may be a locally deployed private system that provides services to a single enterprise, or may be a publicly (or semi-publicly) accessible distributed system that provides services to multiple, possibly unrelated customers and tenants, or may be a combination of both. In addition, a data center may be contained within a single geographic location or may be distributed to multiple locations around the world and provide redundancy and disaster recovery capabilities. For example, a data center may designate one virtual machine on a server as the primary location for a tenant's application, and may activate another virtual machine on the same server or another server as a secondary or backup in the event of a failure of the first virtual machine or server.

[0019] A cloud computing environment is typically implemented in one or more recognized models to run in one or more network-connected data centers. A private cloud deployment model includes infrastructure that is operated solely for an organization, whether it is managed internally or by a third party, and whether it is hosted within the organization or at some remote externally deployed location. Examples of private clouds include self-operated data centers. Public cloud deployment models include infrastructure that is made available to the public or a large portion of the public (such as an industry group) and is run by an organization that provides cloud services. A community cloud is shared by several organizations and supports a specific community of organizations with common concerns (such as jurisdiction, compliance, or security). Deployment models typically include similar cloud architectures, but may include specific features that address specific concerns (such as security in a shared cloud model).

[0020] A hybrid cloud is a deployment model that includes two or more clouds, such as private, public, and community clouds, or a combination of two or more of each deployment model, that remain a unique entity. A hybrid cloud includes technologies that bind two or more clouds together and in some examples allow data and application portability across clouds, such as cloud bursting for load balancing, and service interoperability.

[0021] Cloud computing providers typically provide services for cloud computing environments as a service model, which is provided as one or more of the following: infrastructure as a service, platform as a service, and other services including software as a service. Cloud computing providers can provide services via subscriptions to tenants or consumers. For example, software as a service provider provides software applications as subscription services, which are usually accessible from a web browser or other thin client interface, and consumers do not load applications on local computing devices. Infrastructure as a service provider provides consumers with the ability to supply processing, storage, network and other basic computing resources, in which consumers can deploy and run software, which may include operating systems and applications. Consumers generally do not manage the underlying cloud infrastructure, but generally retain control over the computing platform and the applications running on the platform. Platform as a service provider provides consumers with the ability to deploy applications created or acquired by consumers to cloud infrastructure, which are created using programming languages, libraries, services and tools supported by the provider. In some examples, consumers do not manage or control the underlying cloud infrastructure including networks, servers, operating systems or storage, but can control deployed applications and possible configuration settings for the application hosting environment. In other examples, a provider may offer a combination of infrastructure and platform services to allow consumers to manage or control deployed applications and the underlying cloud infrastructure. A platform as a service provider may include infrastructure such as servers, storage, and networking, and may also include middleware, development tools, business intelligence services, database management services, etc., and may be configured to support application lifecycle features including one or more of the following: build, test, deploy, manage, and update.

[0022] Figure 2An example network environment 200 is illustrated having a network device 202, such as a plurality of IoT devices 202a-202n, included in a computer network 204 supported by a backend service 206. In one example, the backend service 206 may include a plurality of backend services in a cloud computing environment. In one example, the network devices 202a-202n may include a microcontroller unit with network capabilities, which in some examples may include a circuit board with a sensor and a communication integrated circuit such as a Wi-Fi chip. The network environment 200 may be configured to run applications to perform tasks with the network device 202 on an IoT hub, which may be included in the backend service 206. The network environment 200 may also include a software development kit to enable developers to create and run applications to perform tasks with the network device 202. The network device 202 may communicate with the backend service 206, and in some examples, with other network devices 202. For example, the network device 202 may send telemetry data to the backend service and the telemetry data may be sent to the network device 202. The backend service 206 can receive telemetry data on a large scale and determine how to process and store the telemetry data. The backend service 206 can also communicate with the plurality of network devices 202, specific network devices in the plurality of network devices 202, or a subset of network devices in the plurality of network devices 202.

[0023] Telemetry data is an automated remote measurement and data collection, and telemetry data includes information collected from network devices 202, which is generated in the form of logs, communications on the network 204, such as between network devices and backend services 206, and between network devices 202. In addition, telemetry data can include anonymous software version information, resource usage, memory access, operating system in use, and many other examples. Monitoring agents from application monitoring software development kits can instrument applications to generate operational data that can help troubleshoot and improve performance. In one example, backend services 206 can include a telemetry system to provide tools to collect data and compress the collected data into analysis, which can include human-decipherable reports.

[0024] Security services 208 are included in backend services 206 to provide to prevent or reduce and resolve malicious activities, including security vulnerabilities in network environment 200 including network device 202. For example, malicious activities may include attempts by an attacker to steal data or pollute data and compromise insight. In another example, malicious activities may include co-opting network device 202 for malicious purposes such as botnet attacks. In yet another example, malicious activities may include denial of service attacks, such as permanent denial of service (PDoS) or bricking of network device 202. In some examples, an attacker may hold network device 202 hostage for ransom with the threat of bricking. In yet another example, malicious activities may include attacking network device 202 to gain a backdoor into a corporate network.

[0025] The security service 208 may provide a variety of features to protect and ensure that the network device 202, the network 204, and the backend service 206 are protected from malicious communications or other threats. The security service may include an isolation feature to prevent unauthorized or unintentional data transmission. In addition, the security service 208 may include network and endpoint protection in the form of firewalls and virtual firewalls. The security service may provide logging and monitoring events, including security-related events with agents. The security service 208 may provide security information indicating malicious activities in the form of security alerts. The security service 208 may include a computer-readable storage device such as a computer-readable storage device kit to store computer-executable instructions to control a processor, such as a server in a data center. For example, the security service 208 may be implemented as part of an infrastructure or platform as a service such as for the network environment 200. In one instance, the security service 208 may include a security information and event management (SIEM) service.

[0026] The huge scale behind the IoT trend brings new security challenges and exacerbates existing security issues. It is estimated that 2.5-30 billion network devices will be put into use soon, and a quarter of network attacks will target network devices. Many network devices, especially traditional IoT devices, contain vulnerable hardware and firmware. Many network devices always collect telemetry data with limited user interaction and operate in remote locations rather than in a protected physical environment, which makes network devices more vulnerable to attacks. In such situations, security solutions may also face huge noise. For example, typical security solutions, such as security solutions for corporate networks of computing devices, can trigger malicious activity alerts on some network assets. Applying security solutions customized for potentially millions or more network devices 200 will generate so many alarms that this number may overwhelm many security administrators and security administrator teams.

[0027] The correlation monitoring service 210 is included in the network environment to work with the security service 208 and can solve the huge noise of security alerts in some examples. In one example, the correlation monitoring service 210 includes a processing module 212 and a deployment module 214. The correlation monitoring service 210 may include a computer-readable storage device such as a computer-readable storage device kit to store computer-executable instructions to control a processor, such as a server in a data center. For example, the correlation monitoring service 210 can be implemented as part of an infrastructure or platform as a service such as for the network environment 200.

[0028] The processing module 212 is configured to collect telemetry data sent from the network devices 202, such as telemetry data between the network devices 202 and the backend services 206 and between the network devices 202. The collected telemetry data is processed to identify correlations between telemetry data streams from different network devices. In one example, if telemetry data from one of the related network devices can be used to predict telemetry data from another of the related network devices, a correlation can be established between the network devices 202. The processing module 212 provides a correlation map between related devices. The correlation map may include a list of devices in the map and expected or predicted telemetry data for the mapped network devices, which is based on actual telemetry data of another device of the map. The map may include two or more network devices. The correlation map is provided to the deployment module 214.

[0029] The deployment module 214 continues to receive and process telemetry data from related devices, which may be referred to as monitored devices of the deployment module 214. The deployment module 214 compares the received telemetry data for the monitored devices with the correlation map from the processing module 212. The deployment module 214 may determine and store the current state of the monitored devices and may provide a determination of whether the network device in the monitored devices is operating as it is expected to or is predicted to operate based on the correlation map. If the network device is not operating as expected, it is indicated as an abnormal device.

[0030] The correlation monitoring service 210 can be operably coupled to the security service 208. In one example, the correlation monitoring service 210 is an independent service that can receive security information from the security service 208 directly or through a network. In another example, the correlation monitoring service 210 is integrated into the security service 208 or a feature of the security service 208 to receive security information. In one example, the correlation monitoring service 210 can receive security information in the form of a security alert for a network device that may be subject to malicious activities such as security vulnerabilities. The correlation monitoring service 210 can merge security information with abnormal devices, such as security alerts, to determine whether the abnormal device has been affected by a security vulnerability. This information can be used to generate a priority alert, which indicates that malicious activity may have occurred in the abnormal device, which is operating outside normal parameters. The correlation monitoring service 210 can be used together with the security service 208 to determine security alerts related to online operations of the network device 202.

[0031] Figure 3 An example method 300 for monitoring the security of multiple network devices is illustrated, such as multiple IoT devices 202 tracked by a correlation monitoring service 210 in a network environment 200, which can filter out the huge noise that affects general IoT security systems. At 302, correlations between multiple network devices are mapped based on telemetry data from multiple network devices to determine related devices. For example, the service 210 collects telemetry data from the network device 202 and the backend service 206. Correlations between devices are established and the correlations are mapped, which may include expected telemetry data of the network device of the correlation mapping, which is based on actual telemetry data of another network device of the correlation mapping. At 304, the behavior of the related devices is monitored based on the telemetry data received from the related devices to determine abnormal devices among the multiple devices. The behavior can be detected inferentially based on the telemetry data. At 306, priority alerts are generated for multiple network devices based on security alerts received for abnormal devices.

[0032] Figure 4 An example method 400 is illustrated of a processing stage of a method of monitoring security of a plurality of network devices 300. In the example, the method 400 collects telemetry data from network devices at 402. Correlations between the telemetry data are identified to map the correlations between the plurality of network devices at 404. The map is generated to include correlated devices and expected telemetry data for the correlated devices, the expected telemetry data being based on actual telemetry data of another correlated device.

[0033] In one example, collecting telemetry data from the network device at 402 may include collecting telemetry data sent from the network device to a central service, such as a backend service or a cloud service provided for the network device. In another example, collecting telemetry data from the network device at 402 may include collecting telemetry data sent from one network device to another network device. In one example, the telemetry data may be stored in an operational log of the network device or the central service, and the system may be configured to receive the telemetry data from the operational log.

[0034] At 404, correlations between telemetry data are identified to map correlations between multiple network devices. For example, telemetry data is used to identify correlations between telemetry data from multiple network devices. Telemetry data associated with each of the multiple network devices is checked (such as read). Telemetry data associated with a network device in the multiple network devices can be compared with telemetry data associated with another network device in the multiple network devices to determine the relevant network devices. For example, telemetry data associated with one network device in the multiple network devices can be compared with telemetry data of all other network devices in the multiple network devices. Telemetry data can relate to various information tracked in the network device, including as parameters measured or tracked by the device, memory usage, power usage, communication-related data, and other data tracked and stored in an operation log.

[0035] An example of a related device or mapping device may include a set of network devices, wherein the telemetry data of one network device in the set of network devices can be used to predict the behavior of other devices in the set of network devices. For example, a change in one device can be used to predict a change in another device mapped to the one device. In one example, the mapping device can be a similar device, i.e., a device that tracks the same parameter, so that if one device measures temperature x0, another device mapped to the one device will be predicted to measure temperature x1, and under normal conditions, the other device mapped to the one device does measure temperature x1. In another example, the mapping device can be a different device that tracks different parameters, so that if one device measures temperature x0, another device mapped to the one device will be predicted to measure flow y0, and under normal conditions, the other device mapped to the one device does measure flow y0. In this example, if a change in the telemetry data of one device can be used to predict a change in another device, the devices are related and can be mapped to each other. In another example, if it can be known that a change in the telemetry data of one device is related to a change in another device, the devices are related and can be mapped to each other. Machine learning may be performed on the telemetry data collected at 402 and used to predict changes in telemetry data received from another device based on the telemetry data received from the mapping device.

[0036] In one example, method 400 generates a map of related devices at 406, the map including related devices and expected telemetry data for the related devices, the expected telemetry data based on actual telemetry data received for the related devices. For example, the map includes expected telemetry data for a device in the related devices, the expected telemetry data based on actual telemetry data received for another related device. The behavior of the related devices can be inferred from the telemetry data of the mapped devices. For example, the behavior of a device can be inferred from the telemetry data of a device, and the behavior of a device can be inferred from the telemetry data of a device associated with a device in the map.

[0037] Figure 5 An example method 500 of the deployment phase of a method for monitoring the security of a plurality of network devices 300 is illustrated. In the example, the method 500 continues at 502 to receive telemetry data from a mapped network device. At 504, the telemetry data for the mapped network device is monitored and compared to the correlation map to determine whether the network device deviates from its expected behavior and becomes an anomalous device. At 506, a security alert is received from a security service and the security alert is merged with the correlation map to determine whether the anomalous device has also generated a security alert. In the example, the method 500 receives a map of related devices provided from the method 400.

[0038] In one example, the telemetry data received at 502 includes data sent from the network device to a central service, such as a backend service or cloud service provided for the network device. In another example, collecting telemetry data from the network device at 502 may include collecting telemetry data sent from one network device to another network device. In one example, the telemetry data may be stored in an operation log of the network device or the central service, and the system may be configured to receive the telemetry data from the operation log.

[0039] At 504, telemetry data for the mapped network device is monitored and compared to the correlation map to determine whether the network device deviates from its expected behavior. For example, telemetry data from a device in the mapped device set is used to associate a relationship with another device in the mapped device set. If the telemetry data received from the other device in the mapped device set is correlated with the telemetry data received from the mapped device, it can be considered that both devices are working as expected. In one example, if the telemetry data received from the other device in the group mapped device set is not correlated with the telemetry data received from the mapped device, one or both of the devices can be considered to deviate from the expected device telemetry data and be marked as an abnormal device at 504. In another example, if more than two devices are related, and the telemetry data received from one device in the mapped device set is not correlated with the telemetry data received from other mapped devices, the one device can be considered to deviate from the expected device telemetry data and be marked as an abnormal device at 504. If one of the correlations is not observed in the telemetry data or if the telemetry data or behavior is unexpected based on the telemetry data received from the associated device, the device behavior is considered to deviate from normal behavior.

[0040] In one example, the method 500 can identify all anomalous devices in a plurality of network devices at any given time. For example, the method 500 can identify information including which devices in a plurality of network devices are or have been anomalous devices, at what time the devices have been anomalous devices, and how many devices have been anomalous devices during a time period or at a point in time.

[0041] At 506, a security alert is received from a security service and the security alert is merged with a correlation map to determine whether an abnormal device has also generated a security alert. Methods 300 and 500 can be coupled to a security service operating on multiple network devices, and the security service can provide a security alert to indicate that the network device has been affected by malicious activity. For example, malicious activities that may cause a security alert from a security service may include damage or exploitation of a network device. In one example, a security service may include an intrusion detection system and many other services that can provide security alerts associated with a network device to indicate that the security of the network device has been compromised. Other examples can be envisioned. The security service can provide information, including which devices among multiple network devices are assigned or have been assigned security alerts, when a device has been assigned a security alert, and how many devices have been assigned security alerts during a time period or at a point in time.

[0042] Information identifying which devices have been assigned security alerts is merged with information identifying which devices are anomalous devices. Devices that are both assigned security alerts and considered anomalous devices are highlighted. For example, anomalous devices that have been assigned security alerts can be provided with priority alerts on the system. This allows the security administrator to know that malicious content has been discovered and the device is not operating as expected. Such priority alerts can generate a priority response to the associated device.

[0043] The example correlation monitoring service 210 and methods 300, 400, 500 may be implemented as a combination of one or more hardware devices and a computer program for controlling a system (such as a computing system having a processor and a memory) to perform methods 300, 400, 500. For example, the correlation monitoring service 210 and methods 300, 400, 500 may be implemented as a computer-readable medium or a computer-readable storage device having an executable instruction set for controlling a processor to perform methods 300, 400, and 500. The correlation monitoring service 210 and methods 300, 400, 500 may be included as a service in a cloud environment and implemented on a computing device 100 such as a data center as a system for providing correlation-based network security.

[0044] Although specific embodiments have been illustrated and described herein, those skilled in the art will appreciate that various alternative and / or equivalent implementations may be used to replace the specific embodiments shown and described without departing from the scope of the invention. This application is intended to cover any modifications or variations of the specific embodiments discussed herein.

Claims

1. A method for generating an alert, comprising: mapping correlations between the plurality of network devices based on telemetry data from the plurality of network devices to determine correlated devices, wherein first correlated device telemetry data is applied to predict second correlated device telemetry data; monitoring the behavior of the related devices based on the telemetry data to determine abnormal devices among the plurality of network devices; as well as A priority alarm is generated for the plurality of network devices according to the security alarm for the abnormal device. 2 . The method of claim 1 , wherein the telemetry data is provided between the network device and a backend service and between network devices. The method of claim 1 , wherein mapping dependencies comprises generating a map of dependent devices. 4 . The method of claim 3 , wherein the mapping includes expected telemetry data of a related device among the related devices, the expected telemetry data being based on actual telemetry data of another related device among the related devices. The method of claim 1 , wherein the expected telemetry data comprises predicted telemetry data of the abnormal device.

6. The method of claim 1, comprising a processing phase including collecting telemetry data from the network devices and identifying a map of correlations between the network devices.

7. The method of claim 6, wherein the mapping comprises a mapping of associated devices and expected telemetry data for the associated devices.

8. The method according to claim 6, comprising a deployment phase, wherein the deployment phase comprises: Telemetry data is received from the correlated devices, the received telemetry data from the correlated devices is compared to the map of correlations to determine the anomalous device, and the security alert is merged with the anomalous device.

9. The method of claim 8, wherein the security alert is received from a security service.

10. The method of claim 1, wherein the determination of the anomalous device is based on unexpected telemetry data from the anomalous device.

11. A computer readable storage device for storing computer executable instructions for controlling a processor to: mapping correlations between the plurality of network devices based on telemetry data from the plurality of network devices to determine correlated devices, wherein first correlated device telemetry data is applied to predict second correlated device telemetry data; monitoring the behavior of the related devices based on the telemetry data to determine abnormal devices among the plurality of network devices; as well as A priority alarm is generated for the plurality of network devices according to the security alarm for the abnormal device.

12. The computer readable storage device of claim 11, wherein the instructions control the processor to receive the telemetry data.

13. The computer readable storage device of claim 12, wherein the instructions control the processor to generate a map of associated devices.

14. The computer readable storage device of claim 13, wherein the instructions control the processor to receive the mapping of associated devices.

15. The computer readable storage device of claim 14, wherein the determination of the abnormal device is based on the received mapping.

16. The computer readable storage device of claim 11, wherein the behavior is inferred from the telemetry data.

17. A system for generating an alert, comprising: a memory device for storing an instruction set; as well as A processor for executing the set of instructions to: mapping correlations between the plurality of network devices based on telemetry data from the plurality of network devices to determine correlated devices, wherein first correlated device telemetry data is applied to predict second correlated device telemetry data; monitoring the behavior of the related devices based on the telemetry data to determine abnormal devices among the plurality of network devices; as well as A priority alarm is generated for the plurality of network devices according to the security alarm for the abnormal device.

18. The system of claim 17, wherein the instructions are implemented using a security service of a cloud environment.

19. The system of claim 17, wherein the memory and the processor are included on a server in a data center.

20. The system of claim 17, wherein the system is provided as a cloud-based service.

Images