A device may receive behavior information that identifies a first user, of a first set of users, in association with a behavior. The behavior may relate to one or more requests, from a client device being used by the first user, to access a network resource. The device may determine, based on a model, whether the behavior is normal. The model may include a normal behavior pattern based on behavior information associated with the first set of users. The device may provide an instruction to allow the client device to proceed with the behavior or provide an instruction to disallow the client device from proceeding with the behavior based on determining whether the behavior is normal. The device may update the model based on the behavior information that identifies the first user and that identifies the behavior.