In an approach, a processor receives from a network device a request. A processor obtains from a database a device profile for the network device. A processor determines whether the device profile of the network device has a data usage pattern related to data identified by a data identifier. In response to determining the device profile has a related data usage pattern, a processor receives the related data usage pattern from the database. In response to determining the device profile does not have a related data usage pattern, a processor obtains a device type profile from the database. A processor classifies the data usage request based on at least one of the device profile and the device type profile. A processor executes a security action based on the classification of the data usage request. A processor stores the data usage request and executed security action to the database.