A method including determining, by a VPN server having established VPN connections with one or more user devices, aggregate amounts of VPN data communicated with a host device; determining difference amounts indicating differences in the aggregate amounts of VPN data communicated with the host device; determining average aggregate amounts of VPN data communicated with the host device based at least in part on averaging the difference amounts; determining a largest average aggregate amount as an average threshold level; and selectively transmitting a notification to the one or more devices indicating that the one or more user devices is to manage transmission of data from the one or more user devices based at least in part on a result of comparing the average threshold level with an observed average aggregate amount of VPN data communicated with the host device during an operation period. Various other aspects are contemplated.