Kaspersky Machine Learning for Anomaly Detection

Settings and example of the Excel file containing tag and asset configuration

The configuration file is created by a qualified technical specialist of the Customer, a Kaspersky employee or a certified integrator. The system administrator loads the configuration of assets and tags into a hierarchical structure in the Assets section in the administrator menu.

The configuration file contains the following tabs:

• readme: A tab containing general information about the configuration file.
• directory_types: A tab that describes the hierarchical structure asset types using the following settings:
  • directory_type_id: The asset type ID. The ID is assigned automatically when exporting the asset tree.
  • directory_type: A unique name for the asset type.
  • parameter<parameter number>_label: Names of special parameters, where <parameter number> corresponds to a value in the range from 1 to 5. If an asset of a given type does not have any special parameter, leave the corresponding field in the configuration file blank.
  • description: The description of the asset type. This field is optional.
• directories: A tab that describes assets of the hierarchical structure using the following settings:
  • directory_id: The asset ID. The ID is assigned automatically when exporting the asset tree.
  • directory_type: The type of asset. The type is selected from the asset types specified on the directory_types tab.
  • directory_type row: The number of the row on the directory_types tab that describes the selected asset type. The field is filled in automatically.
  • directory_name: The unique name of an asset within its parent asset.
  • directory_info: The description of the asset. This field is optional.
  • parent: The parent asset. If the imported asset is at the top level of the asset hierarchy, leave the parent field blank.
  • parent row: The number of the row on which the selected parent asset is described. The field is filled in automatically.
  • parent_id: The ID of the parent asset. The ID is assigned automatically when exporting the asset tree.
  • parameter<parameter number>: Names of special parameters, where <parameter number> corresponds to a value in the range from 1 to 5. Names of special parameters are filled in automatically if special parameters are defined for the selected asset type.
  • value <parameter number>: Values of special parameters, where <parameter number> corresponds to a value in the range from 1 to 5. If an asset does not have a special parameter, leave the field for entering the corresponding value blank.
• tags: A tab that describes tags of the hierarchical structure using the following parameters:
  • tag_id refers to the tag ID. The ID is assigned automatically when exporting primary elements of the hierarchical structure.
  • tag_name is the unique name of the tag.
  • alternate_name: A unique alternative name for the tag. This field is optional.
  • tag_description refers to a description of the tag.
  • parent: The parent asset to which the tag belongs. If the head element of the hierarchical structure is the tag imported by the parent element, leave the parent field blank.
  • parent_row: The number of the row on the directories tab that describes the selected parent asset. The field is filled in automatically.
  • parent_id: The ID of the parent asset. The ID is assigned automatically when exporting the asset tree.
  • tag_type: Type of tag. This field is optional.
    • PV: To designate measurements or observed values of physical parameters.
    • CV: To designate calculated values of physical parameters.
    • IV: To designate tags that are independent of other tags.
    • SV: To designate a setpoint.
    • MV: To designate the controlled values of physical parameters.
    • B: To designate tags in bit format.
    • X: To designate cases that are not tagged.

    If you are finding it difficult to determine the tag type, you can use a question mark (?) as the tag type instead.

  • tag_units: The unit of measure for the tag.
  • red_min: Lower blocking threshold, upon reaching which it is necessary for the ICS to take emergency response measures. This field is optional.
  • red_max: Upper blocking threshold, upon reaching which it is necessary for the ICS to take emergency response measures. This field is optional.
  • yellow_min: Lower signaling threshold, upon reaching which the operator should pay attention to the tag behavior. This field is optional.
  • yellow_max: Upper signaling threshold, upon reaching which the operator should pay attention to the tag behavior. This field is optional.
  • validity_min: The lower threshold for physically possible tag values. This field is optional.
  • validity_max: The upper threshold for physically possible tag values. This field is optional.
  • display_min: The lower boundary for displaying tag values on graphs. This field is optional.
  • display_max: The upper boundary for displaying tag values on graphs. This field is optional.
  • scale: The expression used to calculate the tag value from the value passed to Kaspersky MLAD. Instead of an expression, you can specify a specific number by which the value of the transmitted tag is to be multiplied. If the tag value does not need to be recalculated, leave this field blank.
  • comment: A comment relating to the tag.
  • X is the coordinate of the monitored asset's sensor location. This field is optional.
  • Y is the Y coordinate of the monitored asset's sensor location. This field is optional.
  • Z is the Z coordinate of the monitored asset's sensor location. This field is optional.

Below is an example of a XLSX file containing descriptions of assets and tags and their configuration.

Directory_types tab

Directories tab

tags tab