Techniques are presented herein to provide human mobility pattern based modeling and tracking of a group of network enabled user devices associated with the same person. An association is made, at a tracking device, between a plurality of user devices and a user. Location information for each of the plurality of user devices is derived through network activity of the plurality of user devices. Locations for the plurality of user devices are derived from the location information. One or more predetermined user mobility pattern rules are applied to the plurality of user devices. User anomalies are detected when the tracked locations indicate that one or more of the plurality of user devices has violated one or more the predetermined user mobility rules.