A processor may identify one or more predicted microservice chains for each of one or more user profiles. The one or more predicted microservice chains may be selected based on historical information. The one or more user profiles may each be associated with a respective user of a user device. The processor may analyze user specific information. The user specific information may be associated with the user device. The processor may determine, based on the user specific information, if the user device causes network intrusion. The processor may perform, based on the determination, an action for the user device.