Systems and methods for detecting anomalies in network communication in an industrial automation system. An anomaly detection system, a decentralized system, may identify IoT devices within the network communication and corresponding communication metrics. Using the communication metrics between the identified IoT devices, the anomaly detection system may generate a social network model that is indicative of expected network communication properties. By analyzing social network metrics and overall entropy of the network communication in real time, the anomaly detection system may identify anomalies that may be associated with potential network vulnerabilities.