1. A method performed by a device, comprising: receiving, by the device, one or more of user information, role information, or authorization information associated with a user accessing a network; selecting, by the device, a traffic flow to monitor that is associated with the one or more of user information, role information, or authorization information; monitoring, by the device, the traffic flow; determining, by the device, whether an anomaly of traffic behavior exists with respect to the traffic flow based on a traffic behavior pattern associated with the one or more of user information, role information, or authorization information; and performing, by the device, a security response when it is determined that the anomaly exists.