1. A method comprising: observing, by a monitoring unit within a network, activities relating to a plurality of monitored devices within the network; for each observed activity, assigning, by the monitoring unit, a score to the observed activity based upon a policy of a plurality of polices established within the monitoring unit; for each of the plurality of monitored devices, aggregating, by the monitoring unit, the score and a historical score associated with the monitored device to identify a reputation score for the monitored device; and classifying, by the monitoring unit, a monitored device of the plurality of monitored devices as potentially being a malicious resource based upon the reputation score for the monitored device.