Disclosed are various embodiments for predicting and classifying events that create a sudden or substantial increase in network traffic activity. To begin, an increase of network activity can be detected. Upon detecting the increase in network activity, it can be determined that the increase in network activity is unexpected in view of one or more predicted activity events. The system can be adjusted to reduce the network activity in response to determining that the increase in network activity is unexpected.