Kaspersky Machine Learning for Anomaly Detection

Adding an elliptic envelope-based ML model element

System administrators and users who have the Create models permission from the Manage ML models group of rights can add ML model elements. The functionality is available after a license key is added.

To add an elliptic envelope-based ML model element:

1. In the main menu, select the Models section.
2. To add an elliptic envelope, do the following:
   1. In the asset tree, next to the name of the ML model you want to add an elliptic envelope to, open the vertical menu  and select Create element.
   2. In the window that opens, select the Elliptic envelope item type.
   3. Click the Create button.

   A list of options appears on the right.

3. In the Name field, specify the name of the ML model element.
4. Enter a description for the ML model element in the Description field.
5. In the General element settings block, do the following:
   1. In the Reminder period (sec) field, specify the period in seconds, upon reaching which the ML model will generate a repeated incident if anomalous behavior is retained in each UTG node.

      The default value of this setting is 0, which corresponds to no reminders.

   2. In the Period of recurring alert suppression (sec) field, specify the period in seconds during which the ML model does not log repeated incidents for the same element.

      The default value of this setting is 0 (repeat incidents not suppressed).

   3. In the Anomaly observation interval (sec) field, enter the period (in seconds) during which the anomalous behavior of the tag is monitored to make a decision regarding incident registration.
   4. In Anomaly duration share in interval, enter as a decimal fraction the proportion of the period in Anomaly observation interval (sec) that must elapse for the ML model element to register an incident.

      You can specify a value in the range of 0 to 1.

   5. In the Color of incident dot indicators field, select the color of the indicator points of the incidents logged by the ML model element on the graphs in the Monitoring and History sections. This color will also be used to display the graph of the artifact generated by this element.
   6. If necessary, in the Incident status drop-down list, select a status to be automatically assigned to incidents logged by the ML model element.
   7. If necessary, in the Incident cause drop-down list, select the cause to be automatically set for incidents logged by the ML model element if this cause is known in advance.
   8. In the Detection threshold field, specify the threshold value upon reaching which an incident is registered.

      The value of this parameter will be automatically adjusted after training the ML model element. If necessary, you can change the value of this parameter.

   9. If required, in the Expert opinion field, specify the expert opinion that will be automatically generated for incidents registered by the ML model element if the contents of this opinion are known in advance.
6. In the Grid step (sec) field, specify the element's UTG period (in seconds) expressed as an integer or decimal.
7. In the Input tags drop-down list, select one or several tags to include in the ML model.
8. In the upper-right corner of the window, click the Save button.

When creating the first ML model element, an Elliptic envelopes group will be automatically created in the asset tree. The newly created element appears in this group.

The ML model element will be assigned the Not trained status, and the ML model to which the added element belongs will be assigned the Not trained status. To run inference on the ML model, all of its predictive elements and elliptic envelope-based elements must be trained.