Cyber security system with adaptive machine learning features

A method comprising:

• communicating, via an interface component of a user device, with a server that manages cyber security for a plurality of user devices belonging to an enterprise;
• implementing a machine learning function with a processor of the user device;
• monitoring user interactions with the user device over time to establish a use profile;
• detecting anomalous use of the user device based on a variance from the use profile;
• identifying another user device managed by the server that is associated with the user device;
• in response to detecting the anomalous use of the user device, sending an instruction to the another user device to validate whether an authorized user is in proximity of the another user device;
• determining the anomalous use is representative of a security threat to the enterprise based on input of the anomalous use into the machine learning function;
• controlling the user device to automatically initiate recording behavior of the security threat based on an output of the machine learning function;
• reporting the behavior of the security threat to the server;
• and
• analyzing, at the server, the behavior of the security threat to profile attack patterns for the user devices belonging to the enterprise.

A non-transitory computer readable medium embodying programmed instructions executed by a processor, wherein the instructions direct the processor to:

• communicate, via an interface component of a user device, with a server that manages cyber security for a plurality of user devices belonging to an enterprise;
• implement a machine learning function with the user device;
• monitor user interactions with the user device over time to establish a use profile;
• detect anomalous use of the user device based on a variance from the use profile;
• identify another user device managed by the server that is associated with the user device;
• in response to detecting the anomalous use of the user device, send an instruction to the another user device to validate whether an authorized user is in proximity of the another user device;
• determine the anomalous use is representative of a security threat to the enterprise based on input of the anomalous use into the machine learning function;
• control the user device to automatically initiate recording behavior of the security threat in memory based on an output of the machine learning function;
• report the behavior of the security threat to the server;
• and
• analyze, at the server, the behavior of the security threat to profile attack patterns for the user devices belonging to the enterprise.

A method comprising:

• detecting anomalous use of a user device based on historical use of the user device;
• identifying another user device that is associated with the user device;
• in response to detecting the anomalous use of the user device, sending an instruction to the another user device to validate whether an authorized user is in proximity of the another user device;
• inputting information of the anomalous use into a machine learning function;
• determining a characteristic of a cyber threat from an output of the machine learning function;
• initiate recording behavior of the cyber threat based on the characteristic;
• and
• reporting the behavior of the cyber threat to a server that manages cyber security for the user device and other user devices belonging to an enterprise.