Working with imported ML models

This section provides information about working with imported ML models and their elements.

ML models can be provided by Kaspersky specialists or certified integrators within the Kaspersky MLAD Model-building and Deployment Service. Such ML models must be uploaded to Kaspersky MLAD and activated. You cannot create new elements for an imported ML model, or delete existing elements.

Upon uploading into Kaspersky MLAD the ML model is already trained. If necessary, you can additionally train the neural network elements as part of the uploaded ML model before publishing it and/or executing its inference.

Uploading an ML model

If the ML model was created by Kaspersky specialists or a certified integrator, you can load this ML model into Kaspersky MLAD.

Kaspersky MLAD may slow down its operation when uploading an ML model whose size exceeds 1 GB.

System administrators and users who have the Upload models permission from the Manage ML models group of rights can upload ML models.

To upload an ML model:

1. In the main menu, select the Models section.
2. In the asset tree, next to the name of the asset for which the ML model is to be imported, open the vertical menu and select Import model.
3. In the opened window, select the ML model file.

   An ML model file is provided as a TAR archive with a maximum size of 1.5 GB.

The ML model will be uploaded to Kaspersky MLAD. The new ML model displays in the Models group of the asset tree. The Models group is created automatically and displayed as part of the selected section of the asset tree. The Models group contains the Neural networks and Rules subgroups for storing ML model elements based on neural networks and diagnostic rules.

After being uploaded, the ML model is assigned the Not activated status. The ML model must be activated. If you upload an ML model that was previously activated and then deleted, you do not need to reactivate the ML model.

Activating an imported ML model

After an ML model prepared by Kaspersky specialists or a certified integrator has been uploaded into Kaspersky MLAD, it must be activated.

If the ML model activation code is lost, send a request to Kaspersky to receive a new code.

System administrators and users who have the Activate models permission from the Manage ML models group of rights can activate imported ML models.

To activate an imported ML model:

1. In the main menu, select the Models section.
2. In the asset tree, select the imported ML model.

   The details area appears on the right.

3. In the Model activation code field, enter the code received from Kaspersky personnel, and click the Activate button in the upper right part of the window.

ML model is activated. It will be assigned the Trained status. You can to start ML model inference to begin the analysis of telemetry data received from the monitored asset.

Changing the parameters of an element of an imported ML model

You can change some parameters of an element of an imported ML model.

System administrators and users who have the Edit model drafts permission from the Manage ML models group of rights can edit the settings of elements of imported ML models.

To change the parameters of an imported ML model element:

1. In the main menu, select the Models section.
2. In the asset tree, select the ML model element that you want to change.

   A list of options appears on the right.

3. In the upper-right corner of the window, click the Edit button.
4. In the Name field, specify the name of the ML model element.
5. Enter a description for the ML model element in the Description field.
6. If necessary, in the General element settings settings block, do the following:
   1. In the Reminder period (sec) field, specify the period in seconds, upon reaching which the ML model will generate a repeated incident if anomalous behavior is retained in each UTG node.

      The default value of this setting is 0, which corresponds to no reminders.

   2. In the Period of recurring alert suppression (sec) field, specify the period in seconds during which the ML model does not log repeated incidents for the same element.

      The default value of this setting is 0 (repeat incidents not suppressed).

   3. In the Incident status drop-down list, select a status to be automatically assigned to incidents logged by the ML model element.
   4. In the Incident cause drop-down list, select the cause to be automatically set for incidents logged by the ML model element.
   5. In the Color of incident dot indicators field, select the color of the indicator points of the incidents logged by the ML model element on the graphs in the Monitoring and History sections.
   6. In the Detection threshold field, specify a prediction error threshold value upon reaching which an incident is logged.

      The detection threshold value was set after training an element of the imported ML model. Modifying this setting changes detector sensitivity.

   7. In the Expert opinion field, specify the expert opinion to be automatically created for incidents logged by the ML model element.
7. In the upper-right corner of the window, click the Save button.