Cyber security system with adaptive machine learning features

Systems and methods for a cyber security system with adaptive machine learning features. One embodiment is a system that includes a server configured to manage a plurality of user devices over a network, and a user device that includes an interface and a processor. The interface is configured to communicate with the server over the network, and the processor implements a machine learning function configured to monitor user interactions with the user device over time to establish a use profile, to detect anomalous use of the user device based on a variance from the use profile, to determine whether the anomalous use is representative of a security threat, and to instruct the user device to perform one or more automatic actions to respond to the security threat.

FIELD

The disclosure relates to the field of cyber security, and in particular, to machine learning in cyber security.

BACKGROUND

Cyber security risks for large organizations have become increasingly complex due to the proliferation of network connected devices used in everyday business activities. End user devices such as employees' smartphones may expose sensitive information of the user or organization as a result of targeted cyber threats or physical theft of a device. Conventional approaches to tracking and protecting against such threats do not provide adequate information to efficiently detect, resolve, and understand the impact of device vulnerabilities throughout a large organization.

SUMMARY

Embodiments described herein provide for a cyber security system with adaptive machine learning features. An end user device managed by an Information Technology (IT) system is equipped with a local machine learning function. The machine learning function establishes a user signature that is unique to the particular behavior patterns learned from monitoring use of the user device over time. The user signature is used by the machine learning function to define and detect abnormal use events for the user device, such as use which suggests the user device is stolen, being used by an unauthorized user, or is compromised by malware. After detecting such an event, the machine learning function triggers a series of automatic actions to respond to the security threat. The particular action or sequence of actions taken may adapt over time with the machine learning function to effectively mine data for the suspected threat event including interrogation of bad actor networks and devices and attempts to access specific information or resources on the user device. The mined data may be sent to a central or remote management server also equipped with machine learning functions to identify attack patterns and provide the user device with specific instructions or data (e.g., misinformation to provide to access requests) for responding to the security threat.

One embodiment is a system that includes a server configured to manage a plurality of user devices over a network, and a user device that includes an interface and a processor. The interface is configured to communicate with the server over the network, and the processor implements a machine learning function configured to monitor user interactions with the user device over time to establish a use profile, to detect anomalous use of the user device based on a variance from the use profile, to determine whether the anomalous use is representative of a security threat, and to instruct the user device to perform one or more automatic actions to respond to the security threat.

Another embodiment is an apparatus that includes a processor configured to detect anomalous use of a user device based on historical use of the user device, to input information of the anomalous use into a machine learning function, and to determine a characteristic of a cyber threat from an output of the machine learning function. The processor is also configured to determine an automatic action for the user device to perform based on the characteristic of the cyber threat, and to instruct the user device to perform the automatic action to respond to the cyber threat.

Other exemplary embodiments (e.g., methods and computer-readable media relating to the foregoing embodiments) may be described below. The features, functions, and advantages that have been discussed can be achieved independently in various embodiments or may be combined in yet other embodiments further details of which can be seen with reference to the following description and drawings.

DESCRIPTION

The figures and the following description illustrate specific exemplary embodiments of the disclosure. It will thus be appreciated that those skilled in the art will be able to devise various arrangements that, although not explicitly described or shown herein, embody the principles of the disclosure and are included within the scope of the disclosure. Furthermore, any examples described herein are intended to aid in understanding the principles of the disclosure, and are to be construed as being without limitation to such specifically recited examples and conditions. As a result, the disclosure is not limited to the specific embodiments or examples described below, but by the claims and their equivalents.

FIG. 1illustrates an enterprise network environment100in an exemplary embodiment. The enterprise network environment100includes an enterprise network102with an administration system110that manages computer security for a large organization or enterprise. The enterprise network102also includes an intrusion detection system106formed by edge devices1081, 2 . . . Nsuch as servers, gateways, firewalls, routers, and other network elements that monitor traffic between the enterprise network102and external network(s)124and report/block traffic that is suspicious. The enterprise network102supports User Equipment (UE)1501, 2 . . . Noperated by respective users1521, 2 . . . Nto perform various computer tasks. The UE150may include, for example, personal computers, laptops, smartphones, etc. The UE150may be operated by employees or customers of the enterprise.

As shown inFIG. 1, the UE150may interface with the enterprise network102directly (e.g., operate in) or indirectly (e.g., operate outside of) via one or more external networks124. In any case, the UE150may access external resources126such as websites, databases, and servers over the external network124such as the Internet. Some of the external resources126, or a malicious actor128on the external network124, may pose security threats to the UE150. Security threats may include manual or automated attacks which attempt to access sensitive or valuable information pertaining to the enterprise via the UE150.

Many modern security threats include sophisticated techniques to automatically evolve the threat over time to evade existing detection/response mechanisms. Moreover, sensitive or valuable enterprise information is increasingly subject to attacks that target devices outside the enterprise network102(e.g., mobile devices) which may be exploited at a later time inside the enterprise network102. In previous systems, attacks involving the exploitation or physical theft of network-connected devices related to the enterprise are difficult to detect and security personnel are generally unable to collect information related to the source of the attack which might otherwise be used to identify and remediate security vulnerabilities of the enterprise.

Therefore, to improve computer security of the enterprise network environment100, the administration system110, a remote server130, and the UE150may be enhanced with an adaptive security system170. For the UE150, the adaptive security system170may detect and respond to security threats based on a behavior profile that is unique to a particular device. That is, each UE150may operate with different capabilities, in different environments, and by different users152, and the adaptive security system170may control automatic security actions according to local use and settings of each UE150. For the remote server130, the adaptive security system170may provide supporting functions to the UE150for an on-going security threat. For the administration system110, the adaptive security system170may provide analysis of system-wide security threat patterns to establish attacker profiles and security rules. It will be appreciated that the enterprise network environment100is an exemplary environment for discussion purposes and that the features of the adaptive security system170described herein may be employed in alternative environments and applications. Illustrative examples and details of the operation of the adaptive security system170with respect to the administration system110, the remote server130, and the UE are discussed below.

FIG. 2is a block diagram of the adaptive security system170in an exemplary embodiment. The adaptive security system170includes an interface component202, one or more processors204, and a memory206. The interface component202may comprise a hardware component or device (e.g., transceiver, antenna, etc.) configured to communicate over a network such as the external network124and/or enterprise network102to exchange messages with UE150, the remote server130, or the administration system110. The processor204represents the internal circuitry, logic, hardware, etc., that provides the functions of the adaptive security system170. The memory206is a computer readable storage medium (e.g., read only memory (ROM) or flash memory) for data, instructions, applications, etc., and is accessible by the processor204. The adaptive security system170may include various other components not specifically illustrated inFIG. 2.

The processor204implements a Machine Learning Function (MLF)210. The MLF210may be implemented in any combination of hardware, firmware, and/or software operable to implement machine learning techniques. Machine learning generally refers to an automated process capable of parsing input data, learning from the data, and then adapting its output based on its learning. This differs from traditional computer processes where instructions or programming is predefined and explicit such that the same steps are repeated given the same input. That is, rather than having activities defined in advance, the MLF210may be trained to observe patterns in data and adaptively adjust actions or steps to take over time without explicit hand-coded programming or user intervention/instruction.

FIG. 3is a block diagram of the UE150enhanced with the adaptive security system170in an exemplary embodiment. The UE150may include a user device such as a laptop or smartphone, an edge device108such as a router or network element, or any other device managed by the administration system110of the enterprise network102. The UE150includes one or more processor(s)302configured to process computer-executable instructions to control the operation of the UE150and to implement embodiments of the techniques described herein. The processor302interacts with various subsystems of the UE150including the hardware304. The hardware304includes memory306, embedded hardware components330, processing input components335, and network components340. In this example, the hardware components330include a display331operable to receive touch screen input, a camera332operable to capture images and video, a speaker333operable to project sound, and a microphone334operable to capture sound. The processing input components335include Input/Output (I/O) peripherals336such as keyboards and external storage devices, one or more processor(s)337, and random access memory (RAM)338. Exemplary network components340include communication components for Bluetooth341, global positioning satellite (GPS)342, WiFi343, and radio344.

The UE150is enhanced with the adaptive security system170that includes the MLF210coupled with modules360-365. More particularly, the adaptive security system170includes an activity monitoring module360, an anomaly detection module361, a threat response module362, an initialization module363, a honeypot module364, and a report module365. Each of the modules360-365may be implemented in any combination of hardware, firmware, and software and may interface with, or be implemented in, the MLF210to perform machine learning techniques for detecting and responding to security threats. Components of the adaptive security system170and/or MLF210may be implemented within parts of the operating system (OS)310, the kernel312of the OS310(e.g., in protected area of memory306on top of kernel312of the OS310, a hardware abstraction layer (HAL)318, within separate programs or applications, in specialized hardware buffers or processors, or any combination thereof. Additionally, it is contemplated that the components of the adaptive security system170and/or MLF210may be stored in memory306for use by the processor302or temporarily loaded in RAM338for use by the processor302.

Generally, the OS310includes an application layer305which may include native and user-installed applications, a framework layer307which may include services, managers, and runtime environments, and a library layer308which may include system libraries and other user libraries. A user may interact with the OS310through an interface303such as a graphical user interface (GUI) that presents menus, buttons, and selectable control items to control and use applications running on the OS310. The HAL318is a layer between the OS310and the hardware layer and serves for adjusting the OS310to different processor architectures. The OS310may include the HAL318in the kernel312or in the form of device drivers that provide a consistent interface for applications to interact with the hardware peripherals. Alternatively or additionally, the HAL318may coordinate application programming interfaces (APIs) at various levels of the UE150to monitor/observe system events, state changes, etc. As such, the OS310and/or the HAL318may provide various security settings for the UE150that authorize applications or actions for accessing hardware or resources of the UE150.

The modules360-365may modify operations of the OS310and/or the HAL318to adapt security settings for the UE150. For instance, the activity monitoring module360may monitor various internal services and activities of the OS310occurring on the UE150such as a change in the types of Input/Output (I/O) requests directed at memory306, a change in how often files of the file system314are accessed, modified, renamed, etc. The activity monitoring module360may detect changes in the communication requests received via system services316on internal data pathways to record various exchange instructions, messages, or events with the subsystems of the UE150occurring via the OS310and/or HAL318. The activity monitoring module360may interact with the MLF210to obtain learned characteristics, to determine whether to reduce or increase the number of resources being monitored, or to determine whether to change the resources being monitored. The activity monitoring module360may also store the recorded information as device use data374in memory306.

The anomaly detection module361is configured to determine whether the UE150device exhibits anomalous behavior. The anomaly detection module361may interact with the MLF210to obtain a characteristic of a security threat from anomalous use information, such as a threat level, type, classification. Alternatively or additionally, the anomaly detection module361may generate attacker data376that identifies or predicts information about a security threat such as an identity or action of an attack. The threat response module362is configured to select a plan of action for a particular type of anomalous behavior or security threat. The initialization module363is configured to apply security settings370, parameters371, or other policies, rules, or user settings as parameters for performing operations with the MLF210. The honeypot module364is configured to prevent or interfere with user requests or actions. The honeypot module364may use the HAL318to implement protected data373to hide sensitive information and/or to generate/provide incorrect data377that diverts a malicious request for data to an incorrect data set. The report module365may implement machine-to-machine communication or automatic message exchanges to send the device use data374and/or attacker data376to a remote server130, the administration system110, or a peer UE150for external detection/response to security threats. Additional details of the operations of modules360-365to perform machine learning techniques tailored to the UE150to detect security threats and trigger an automatic series of actions are discussed below.

FIG. 4is a block diagram of the remote server130enhanced with the adaptive security system170in an exemplary embodiment. The remote server130includes an interface component402configured to communicate with the UE150and/or the administration system110over one or more external networks124, one or more controllers404, and a memory406. The controller404represents the internal circuitry, logic, hardware, etc., that provides the functions of the remote server130. The memory406is a computer readable storage medium for data, instructions, applications, etc., and is accessible by controller404. The remote server130may include various other components not specifically illustrated inFIG. 4.

The controller404implements the adaptive security system170including the MLF210and a disinformation module414. The disinformation module414be implemented in any combination of hardware, firmware, and software and may interface with, or be implemented in, the MLF210to perform machine learning techniques for detecting and/or responding to security threats The controller404also implements a device subgroup manager420configured to manage security features remotely over the external network124for one or more of the UE150grouped by a common characteristic such as a location, region, network, department, user group, or worksite associated with the enterprise. Subgroups of the UE150may also be based on a common type of device, model, platform, hardware, security attributes, or usage that is common. The device subgroup manager420may input device behavior information from the UE150into the MLF210to establish anomalous device use data and other security event data from the population of the UE150in a pattern database422. The pattern database422may be used to train the MLF210to identify patterns and adapt recommendations on control of the UE150for a particular type of security threat. For instance, the disinformation module414may use the MLF210to provide incorrect data377to the UE150according to patterns in the pattern database422. Additionally, the adaptive security system170adapted to perform functions on behalf of the administration system110and/or one of the UE150. For instance, a regional security manager may authenticate users of the UE150and issue commands that revoke privileges, terminate applications, or otherwise disable functions on the UE150which have been compromised or stolen. Thus, in the remote server130, the adaptive security system170may change the characteristics or patterns it looks for in data and/or how it classifies/responds to input based on a subgroup characteristic of the UE150.

FIG. 5is a block diagram of the administration system110enhanced with the adaptive security system170in an exemplary embodiment. The administration system110includes an interface component502configured to communicate with the UE150and/or the administration system110over one or more internal networks such as enterprise network102and/or one or more external networks124. The administration system110also includes a graphical user interface (GUI)508configured to display intrusion event sequences. The administration system110further includes one or more controllers504, and a memory506. The controller504represents the internal circuitry, logic, hardware, etc., that provides the functions of the administration system110. The memory506is a computer readable storage medium for data, instructions, applications, etc., and is accessible by controller504. The administration system110may include various other components not specifically illustrated inFIG. 5.

The controller504implements the adaptive security system170including the MLF210and one or more modules560-563including an activity monitoring module560, an anomaly detection module561, a threat response module562, and a display module563. Each of the modules560-563may be implemented in any combination of hardware, firmware, and software and may interface with, or be implemented in, the MLF210to perform machine learning techniques for detecting and responding to security threats. The controller504also implements a global device manager520that manages system-wide security policies for devices that operate within or interact with the enterprise network102, such as the edge devices108and the UE150. Moreover, the administration system110may include or be coupled with a device database522that maintains user, device, and pattern information for the UEs150which may be distributed/retrieved by an authorized UE150or remote server130and applied to machine learning to tailor the security of the enterprise network environment100to the particular needs of the end-user of the UE150or enterprise.

The administration system110also includes a network traffic manager530configured to route anomalous traffic detected at the edge devices108to the MLF210to establish traffic patterns in a traffic database532. Anomalous traffic information obtained from the edge devices108and anomalous device use information obtained from the UE150may be aggregated at the administration system110and applied to the MLF210to detect vulnerabilities of the enterprise and refine policies of the global security manager114. Numerous configurations of the administration system110, the remote server130, and the UE150are possible. For instance, the administration system110and/or the remote server(s)130may independently or cooperatively implement cloud functionality or a cluster of servers/computers that perform the same or similar set of functions described but in a distributed manner. Additionally, through the modules (e.g., modules360-365of the UE, the disinformation module414of the remote server, and modules560-563of the administration system110) are described as performing various operations, such modules are merely examples and the same or similar functionality may be performed by a greater or lesser number of modules, and may be implemented to perform similar functionality on various platforms (e.g., a peer UE150, the remote server130, the administration system110, etc.) as discussed below.

FIG. 6is a flowchart illustrating a method of detecting and responding to a security threat in an exemplary embodiment. The method600will be described with respect to the enterprise network environment100ofFIG. 1, although one skilled in the art will recognize that methods described herein may be performed by other devices or systems not shown. The steps of the method600may be performed by one or more of the UE150, one or more of the remote servers130, the administration system110, or some combination thereof. The steps of the methods described herein are not all inclusive and may include other steps not shown. The steps may also be performed in an alternate order.

Initially, the administration system110may define security policies to distribute to the remote servers130and the UE150under its domain. Security personnel of the administration system110or user of the UE150may provide custom security policies to target a particular one or group of the UE150, users, threat types, machine responses, etc.

In step602, a processor (e.g., processor302of the UE150, controller404of the remote server130, and/or, controller504of the administration system110) implements the MLF210. That is, the MLF210may be used to perform machine learning techniques in any of the steps/flowcharts described herein. Though steps of the flowcharts herein generally refer to the adaptive security system170, it is understood that the adaptive security system170and the MLF210may perform actions at UE150, the remote server130, and/or the administration system110in various combinations. That is, machine learning may be applied in each step of a method and performed by the UE150, the remote server130, and/or the administration system110in various combinations as described in further detail below.

The MLF210may implement any number of suitable machine learning processes, algorithms, or techniques including anomaly detection, Naive Bayes classifiers, support vector machines, decision tree learning, neural network learning, reinforcement learning, etc. The machine learning processes may be tailored with machine learning parameters by matter of design choice (e.g., kernel type for support vector machines, number of trees for decision trees, etc.). The MLF210may transform the input values to determine patterns, correlations, features, statistics, predictions, or classifications.

In step604, the adaptive security system170monitors user actions with the UE150over time to establish a use profile. At the UE150, the activity monitoring module260may monitor the UE150and record the device use data374in memory306. For instance, the UE150may monitor and/or record user behavior (e.g., keystrokes, gestures, speech, motion, location, etc.), system operations (e.g., notification alerts, application requests for a system resource, processor interrupts, etc.), personal information of the user152(e.g., contact information, calendar information, etc.), content received from another source (e.g., a phone call, a download, a website access, etc.) and/or stored on the UE150(e.g., audio data captured from the microphone334, image or video data captured from the camera332).

The report module365may send the device use data374to the remote server130and/or the administration system110at particular intervals, in response to being triggered remotely by the remote server130and/or the administration system110, and/or in response to being triggered in response to an event detected in the enterprise network environment100. The historical use patterns associated with the UE150may be stored at the UE150, the remote server130, and/or the administration system110.

Furthermore, the UE150may store (e.g., in memory306) or be associated with (e.g., in device database522of the administration system110) predefined characteristics and/or learned characteristics that trigger the UE150to record data related to use of the UE150. That is, predefined characteristics and/or learned characteristics may identify a combination of events, types of data, locations, or particular points of time for which the UE150may be subject to anomalous use for accurate monitoring and/or recording of device use data. Exemplary triggers include a location or direction of travel of the UE150(e.g., in relation to a known or projected location obtained from calendar information or an external data source), an authority of the user152to use particular data or features of the UE150(e.g., in relation to a time or work project for which the user is authorized), or behavior of the user152over a period of time (e.g., in relation to an exceeded threshold different from an established behavior pattern during a similar period of time, time of day, etc.). Such trigger policy information may be provided to the UE150by the administration system110and/or the remote server130.

In step606, the adaptive security system170detects anomalous use of the UE150based on a variance from the use profile. The anomalous use may be analyzed by MLF210on any of the UE150, the remote server130, and/or the administration system110to detect the anomalous use. The analysis may occur in real-time or may occur at a later point in time (e.g., at predefined periods of time, after the UE150is back in range or reconnected to a compatible device/system, etc.). As discussed above, the MLF210may evolve/update over time without predefined instruction. Thus, detection of the anomalous use may be specific to the UE150relative to its device signature or use profile associated with the UE150.

In step608, the adaptive security system170determines whether the anomalous use is representative of a security threat. The adaptive security system170may determine a characteristic of a cyber threat from an output of the MLF210. That is, after using the anomalous use information to train one or more of the MLF210over time, the machine learning result that is output may, for example, be used to classify a type of cyber threat, predict a likelihood of a future cyber threat action, or determine that a threshold rate of change in the data correlates with a particular type of security vulnerability of the UE150. In some embodiments, the MLF210output may predict or expose previously unascertained details data related to the anomalous use such as the tactics, techniques, or procedures used by an attacker. Moreover, the MLF210output may identify or predict indicators or data resources left behind as a result of a cyber attack such as Internet Protocol (IP) addresses of servers used to orchestrate the attack or hashes or registry keys of files used in the attack.

In step610, the adaptive security system170instructs the UE150to perform one or more automatic actions to respond to the security threat. That is, the threat response module362may select one or more actions to perform via an output from the MLF210. Alternatively or additionally, the UE150may receive an output from the MLF210or instruction from the remote server130and/or the administration system110as an automatically executable instruction. The automatic actions are described in further detail below.

FIG. 7-10are flowcharts illustrating methods for automatically responding to security threats in exemplary embodiments. The methods will be described with respect to the enterprise network environment100ofFIG. 1, although one skilled in the art will recognize that methods described herein may be performed by other devices or systems not shown. The steps of the methods may be performed by one or more of the UE150, one or more of the remote servers130, the administration system110, or some combination thereof. The steps of the methods described herein are not all inclusive and may include other steps not shown. The steps may also be performed in an alternate order.

FIG. 7illustrates a method700for determining an automatic action to perform to respond to a security threat. The steps of method700may be performed as part of step610described above. In step702, the adaptive security system170classifies the security threat. The classification of the security threat my trigger the UE150to perform one or a sequence of actions as part of a forensic action plan704, a defensive action plan706, and/or an offensive action plan708. For example, a locus of suspicious events at a particular time, for a particular device/user/worksite, or of a particular type may trigger a specific sequence of actions. Moreover, the actions determined by the MLF210of the adaptive security system170may be specific to a certain UE150, its parameters, security settings, learned characteristics, etc.

The forensic action plan704may include monitoring a target resource of the UE150such as a particular application, file, or hardware component and/or authenticating the UE150using predefined or learned characteristics. The defensive action plan706may include hiding sensitive data or files, restricting access or permission of an application or user, and collecting additional information of an ongoing attack to identify attackers or establish attacker identity profiles. The offensive action plan708may include destroying sensitive data or files, providing disinformation or incorrect data sets in response to a request to access sensitive data of files, spoofing a wireless network using a hotspot to mine data from devices in range, jamming wireless and cellular signals, and limiting the performance or restrict the capability of the UE150so that a larger volume of data can be mined for the ongoing attack (e.g., log keystrokes, camera images/video, microphone audio, etc.).

FIG. 8illustrates a method800for implementing an exemplary forensic action plan704. In step802, the adaptive security system170detects that the UE150is compromised by a security threat. The administration system110may detect that the UE150is compromised by a security threat via its own MLF210or in response to message relayed from the MLF210of the UE150and/or remote server130. In step804, the adaptive security system170postpones invalidating access of the UE150to the enterprise network102for a period of time. In step806, the adaptive security system170instructs the user device to record behavior of the security threat. In step808, the UE150reports the behavior of the security threat to the administration system110. Thus, if the UE150is compromised or stolen, the administration system110may use the UE150to collect information about its attacker rather than excluding it as part of the enterprise.

The UE150may monitor and/or record attacker behavior (e.g., keystrokes, gestures, speech, motion, location, etc.), system operations (e.g., notification alerts, application requests for a system resource, processor interrupts, etc.), personal information resources (e.g., contact information, calendar information, etc.), content received from another source (e.g., a phone call, a download, a website access, etc.) and/or stored on the UE150(e.g., audio data captured from the microphone334, image or video data captured from the camera332, etc.). In one embodiment, the adaptive security system170instructs the UE150to activate at least one of the hardware components330(e.g., the microphone334, the camera332, one of the network components340, etc.), and to record the behavior of the security threat by monitoring the hardware components330. The administration system110may receive and analyze the behavior of the security threat to profile attack patterns for the UEs150under its management as discussed in further detail below.

FIG. 9illustrates a method900for implementing an exemplary offensive action plan708. In step902, the adaptive security system170detects that the UE150is compromised by a security threat. In step904, the adaptive security system170identifies sensitive information accessible via the UE150. For example, policy information or rules identifying sensitive information may be provided from the administration system110to the UE150and stored as protected data373in memory306of the UE150. In step906, the adaptive security system170identifies an incorrect data set for the UE150to provide based on a characteristic of the security threat. For example, the honeypot module364of the UE150and/or the disinformation module414of the remote server130may interact with the MLF210to generate, select, and/or provide the incorrect data377to memory306of the UE150. Then, in step908, the UE150provides the incorrect data377in response to a request to access the sensitive information.

FIG. 10illustrates a method1000for implementing another exemplary offensive action plan708. In step1002, the adaptive security system170detects that the UE150is compromised by a security threat. In step1004, the adaptive security system170instructs the UE150to activate a hardware component to discover nearby devices. For example, the MLF210may output an instruction to the UE150to activate WiFi343to spoof a wireless network using a hotspot or to activate Bluetooth341to discover or connect with nearby devices. In step1006, the activity monitoring module360/560may monitor and record data related to message exchanges with the hardware component to collect information of the nearby devices. In step1008, the UE150reports the collected information of the nearby devices to the administration system110(e.g., a management server including global device manager520).

FIG. 11is a flowchart illustrating a method1100for determining whether anomalous is indicative of a security threat in an exemplary embodiment. In step1102, the adaptive security system170detects that the UE150is associated with anomalous use. In one embodiment, detection of the anomalous use may occur at the UE150, a peer of the UE150(e.g., another user device managed by the administration system110), the remote server130, or the administration system110.

In step1104, the adaptive security system170references the use profile of the UE150to identify a peer UE150associated with the UE150. In step1106, the adaptive security system170initiates an automatic communication exchange with the other device to validate use of the UE150. For instance, the remote server130or the administration system110may authenticate a user of a mobile device by issuing a command to that user's laptop (or smart wearable, smart automotive system, etc.) to turn on its microphone, validate the user's voice, and report a result of the validation. In doing so, the remote server130or the administration system110may reference learned characteristics of multiple UE150(e.g., in memory306as device use data374, in device database522of administration system110, etc.) which are associated with a same user and/or which are commonly connected with one another or in range of connection, sound of speaker333, in view of the camera332, etc. as established by the learned device use. The learned characteristics may also include timing information associated with device proximity such that the remote server130or the administration system110may issue timely commands to accurately ascertain the status of the UE150via its peer. Thus, the UE150may collaborate with its peer UE150, remote servers130, and/or the administration system110to enable accurate detection and precise response to a security threat. Then, in step1108, the adaptive security system170classifies the anomalous use to determine whether it is a security threat. If it is, the remote server130or the administration system110may reference the device database522to identify characteristics which may inform action decisions to respond to the security threat. If not, the adaptive security system170may authorize the use and use it as a training example to adapt the MLF210and the anomaly detection module361/561.

FIG. 12is a flowchart illustrating a method1200for deriving a graphical intrusion event sequence in an exemplary embodiment. In step1202, the network traffic manager530of the administration system110interacts with the MLF210to establish a communication pattern received by a network device (e.g., edge device108) over a network interface. In one embodiment, the activity monitoring module360of the edge device108may detect/provide the pattern to the network traffic manager530. In step1204, the adaptive security system170detects an intrusion event sequence in the communication pattern via the MLF210. For instance, the MLF210may analyze packet headers, frames, IP addresses, forwarding tables, or transmission routes (number of hops) between packets at a server of the enterprise network102and determine whether past activity (established as normal activity) is different from current activity. In step1206, the adaptive security system170generates a graphical simulation of the intrusion event sequence. For example, the display module563may derive an intrusion event sequence for one or multiple UE150, filter events by intrusion patterns, user, location, etc., and provide a step-by-step playback of intrusion events to the GUI508.

FIG. 13is a flowchart1300illustrating a method for updating security policies of an enterprise network environment100in an exemplary embodiment. In step1302, the adaptive security system170aggregates patterns. The network traffic manager530may forward traffic patterns to the traffic database532and the global device manager520may forward device use patterns to the device database522. In step1304, the adaptive security system170constructs attacker profiles based on the patterns. Then, in step1306, the adaptive security system170updates policy rules for the enterprise network102. For example, if attacks have been found to target specific areas of the enterprise network102, the specific areas can become high priority checkpoints for more intensive/frequent monitoring by the activity monitoring module560.