This disclosure is directed to a protection system including machine learning snapshot evaluation. A device may comprise a machine learning engine (MLE) to generate snapshots of device operation. The MLE may use active or planned operations in the snapshot to learn user behavior. Once normal user behavior is established for the device, the MLE may be able to determine when snapshots include unusual behavior that may signify a threat to the device. Snapshots determined to include unusual behavior may be transmitted to a remote resource for evaluation. The remote resource may include at least a user behavior classification engine (UBCE) to classify the user behavior by characterizing it as at least one type of use. The snapshot may be analyzed by the UBCE to determine if potential threats exist in the device, and the threat analysis may be provided to the device for evaluation and/or corrective action.