A method including configuring a virtual private network (VPN) server, having established VPN connections with one or more user devices, aggregate amounts of VPN data communicated with a host device; configuring the VPN server to determine difference amounts indicating differences in the aggregate amounts of VPN data; configuring the VPN server to determine average aggregate amounts of VPN data; configuring the VPN server to determine a largest average aggregate amount, from among the average aggregate amounts, as an average threshold level; and configuring the VPN server to selectively transmit a notification to the one or more devices indicating that the one or more user devices is to manage transmission of data from the one or more user devices based at least in part on a result of comparing the average threshold level with an observed average aggregate amount. Various other aspects are contemplated.