Provided is predictive modeling for anti-malware solutions. A profile for a device is determined based on at least one characteristic identified from a successful attempt by the device to access a network. An expected characteristic for a next access attempt by the device to access the network is determined based on the profile. The characteristic of the next access attempt is matched to the expected characteristic. In response to determining that at least one characteristic of the next access attempt matches the expected characteristic, the next access attempt by the device to the network is automatically granted.