A network security system detects anomalous network device behavior associated with a network device in a group of similar network devices based on baseline network device behavior determined for the group. A graphical visualization may be generated to analyze the groups.