Kaspersky Machine Learning for Anomaly Detection

Viewing summary data in the Dashboard section

The Dashboard section provides summary information on the number of tags and events received by Kaspersky MLAD, registered incidents, and the status of services.

The information on the page is divided into the following blocks:

• Incoming data is a graph that displays the number of tags and events received by Kaspersky MLAD. You can enable or disable the display of incoming tags and events on the graph by clicking the corresponding data signature legend under the graph. The left scale of the graph displays the range for the number of incoming tags per second. The right scale of the graph displays the range for the number of incoming events per second.
• Latest incidents is a table that contains information about the latest registered incidents.
  • ID refers to the ID of the registered incident.
  • Date and time refers to the date and time when the incident occurred.
  • Detector is the name of the detector that registered the incident.
  • Top tag refers to the name of a technological process parameter for which the incident is registered.

  Clicking the plus () next to the incident in the incidents table opens a window with the technical specification of the selected incident and tag:

  • Incident is a section containing information about the incident:
    • Model name refers to the name of the utilized ML model.
    • Model branch is the name of the ML model branch being used.
    • Detector is the name of the detector that registered the incident.
    • MSE value is the value of the individual mean square error.
    • Threshold value refers to the MSE threshold value for the ML model branch in use at the time of incident registration.
  • Top tag is the section containing information about the tag for which the incident is registered:
    • Top tag name (top tag ID) is the name and ID of the tag whose behavior invoked registration of the incident.
    • Top tag value is the value of the top tag registered when the incident occurred.
    • Blocking threshold refer to the thresholds of the top tag values, upon reaching which it is necessary for the ICS to take emergency response measures.
    • Description refers to a description of the top tag.
    • Measurement units refer to the units for measuring the top tag values.
• Machine learning is a table that displays the status of services used for operation and training of the ML model, and the name of the active ML model.
• Status of services is a table that displays the status of each service.

You can proceed to the History section from the Dashboard section by clicking the date and time of an incident in the Latest incidents table. The History section displays detailed information about the incidents registered by Kaspersky MLAD.

Dashboard section