Protecting network devices from suspicious communications

A method comprising:

• determining, based on communication associated with a first security device of a plurality of security devices in a home security system and information associated with expected communication behavior for the first security device, a degree of communication deviation;
• comparing the degree of communication deviation with a threshold;
• and
• causing, based on whether the degree of communication deviation exceeds the threshold, application of one or more communication parameters to further communication to or from the first security device.

A method comprising:

• determining a first change in communication behavior of detected Internet communication associated with a first device of a plurality of devices in a premises network;
• determining a second change in communication behavior of detected Internet communication associated with a second device of the plurality of devices in the premises network;
• and
• restricting, based on the first change in communication behavior and the second change in communication behavior, further communication between the first device and the second device.

An apparatus comprising:

• one or more processors;
• and
• memory storing instructions that, when executed by the one or more processors, cause the apparatus to:
• determine, based on detected Internet communication associated with a first device of a plurality of devices in a premises network and information associated with expected communication behavior for the first device, a degree of communication deviation;
• compare the degree of communication deviation with a threshold;
• and
• restrict, based on the comparing, further communication to or from the first device.

An apparatus comprising:

• one or more processors;
• and
• memory storing instructions that, when executed by the one or more processors, cause the apparatus to:
• determine, based on communication associated with a first security device of a plurality of security devices in a home security system and information associated with expected communication behavior for the first security device, a degree of communication deviation;
• compare the degree of communication deviation with a threshold;
• and
• cause, based on whether the degree of communication deviation exceeds the threshold, application of one or more communication parameters to further communication to or from the first security device.

An apparatus comprising:

• one or more processors;
• and
• memory storing instructions that, when executed by the one or more processors, cause the apparatus to:
• determine a first change in communication behavior of detected Internet communication associated with a first device of a plurality of devices in a premises network;
• determine a second change in communication behavior of detected Internet communication associated with a second device of the plurality of devices in the premises network;
• and
• restrict, based on the first change in communication behavior and the second change in communication behavior, further communication between the first device and the second device.

A non-transitory computer-readable medium storing instructions that, when executed, cause:

• determining, based on detected Internet communication associated with a first device of a plurality of devices in a premises network and information associated with expected communication behavior for the first device, a degree of communication deviation;
• comparing the degree of communication deviation with a threshold;
• and
• restricting, based on the comparing, further communication to or from the first device.

A non-transitory computer-readable medium storing instructions that, when executed, cause:

• determining, based on communication associated with a first security device of a plurality of security devices in a home security system and information associated with expected communication behavior for the first security device, a degree of communication deviation;
• comparing the degree of communication deviation with a threshold;
• and
• causing, based on whether the degree of communication deviation exceeds the threshold, application of one or more communication parameters to further communication to or from the first security device.

A non-transitory computer-readable medium storing instructions that, when executed, cause:

• determining a first change in communication behavior of detected Internet communication associated with a first device of a plurality of devices in a premises network;
• determining a second change in communication behavior of detected Internet communication associated with a second device of the plurality of devices in the premises network;
• and
• restricting, based on the first change in communication behavior and the second change in communication behavior, further communication between the first device and the second device.