Embodiments are disclosed for preventing network attacks. The techniques include generating a usage profile for a computing device that accesses a network. The techniques also include determining a plurality of actual use real-time indicators for a network connection on the network. The techniques further include determining a plurality of expected use real-time indicators for the network connection. Additionally, the techniques include calculating a risk assessment value for the network connection based on the actual use real-time indicators and the expected use real-time indicators. Further, the techniques include performing a security action for the network connection based on the calculated risk assessment value.