A method, an intelligent switch, a device, and a network for recognizing deviations in communication behavior of the network are provided. Characteristics of communication are monitored and evaluated regarding security behavior of the network using a model of a communication behavior of the network. For each communication over a switch of the network, at most three security values are derived from communication metadata of the respective communication using the model of the communication behavior. For each communication, it is checked whether the respective at most three security values meet respective predetermined threshold values. When the respective predetermined threshold values are not met by at least one of the security values, a security warning is generated.