A program product for detecting abnormal behavior of users is disclosed. A computer identifies first and second users based on user definitions and at least one personal device associated with the users. Activities of the users are monitored in real time based on the user definitions, location data received over a time series from the personal devices. A proximity distance, between the personal devices over the time series, is identified based on the location data. The computer generates movement patterns for the personal devices over the time series based on the location data and the proximity distance and creates a workflow. The computer compares the current location with the workflow in real time, and detects a deviation from the workflow in response to the comparing the current location in real time. The computer generates an alert in response to the detecting deviation in real time.