1. A method comprising: maintaining, by a monitoring unit executing on a network security device protecting a private network, a plurality of policies in a form of rules, wherein each policy of the plurality of policies specifies a behavior and a corresponding score; maintaining, by the monitoring unit, a current reputation score for each monitored client device of a plurality of monitored client devices within the private network by: observing, by the monitoring unit, network traffic associated with the monitored client device, including a plurality of network interactions or attempted network interactions between the monitored client device and one or more resources within the private network or one or more resources external to the private network by actively snooping/sniffing, by the monitoring unit, the network traffic; identifying, by the monitoring unit, perceived risky activities represented by the network traffic by performing packet-based inspection of the network traffic, wherein the packet-based inspection includes identifying one or more of indications regarding failed Domain Name Server (DNS) resolution and indications regarding DNS resolution to undesired sites external to the private network; and updating, by the monitoring unit, the current reputation score for the monitored client device, by determining a score for the network traffic based upon a matching policy of the plurality of polices and revising the current reputation score based upon the current reputation score and the determined score; and when the current reputation score for a particular monitored client device of the plurality of monitored client devices meets a predetermined threshold, classifying, by the monitoring unit, the particular monitored client device as potentially being malicious.