Kaspersky Machine Learning for Anomaly Detection

Training an elliptic envelope-based ML model element

With Kaspersky MLAD, you can train an elliptic envelope-based element for an ML model that was created manually, imported into Kaspersky MLAD, created from a template, or copied.

System administrators and users who have the Train models permission from the Manage ML models group of rights can train elements of ML models. The functionality is available after a license key is added.

To train an ML model element:

1. In the main menu, select the Models section.
2. In the asset tree, select the elliptic envelope-based element that you want to train.

   A list of options appears on the right.

3. Open the Training tab and click the Edit button in the upper-right corner of the window.
4. In the Data selection interval field, specify the data time interval on which you want to train the ML model.
5. To apply markups when selecting data for training the ML model within a selected interval, select one or several markups in the Markups field.

   The selected markups will form a

   learning indicator

   

   A set of criteria used to determine the data time intervals on which the ML model performs the training.

   .

6. To view the data that will be selected by the markups, click On graph.

   Markups are displayed in the colors that were specified when they were created.

   You can select a preset when viewing the data on the graph.

7. If you need to configure extended training settings, turn on Advanced training settings toggle switch.
8. In Sample fraction for estimating the mean and covariance, enter as a decimal fraction the proportion of the training sample the covariance and mean are being calculated on.

   You can specify a value in the range of 0 to 0.5 inclusive.

9. In Outliers in sample, enter as a decimal fraction the proportion of outliers (anomalies) in the training sample.

   You can specify a value in the range of 0 to 1. This setting automatically overrides the Detection threshold as set when the element was created. As the percentage of outliers in the training data increases, the threshold for registering an incident decreases. After training the element, you can adjust the incident registration threshold manually.

10. In Initialization of pseudorandom number generator, set a value for generating a pseudorandom number sequence.
11. In the Resolution of training results graphs field, use a decimal value to specify the graph resolution for displaying training results on the Training results tab.

    You can specify a value in the range of 0 to 1. The higher the value, the better the quality of the graphs.

12. If you assume that the tag values are centered and their mean is equal to zero, turn on Data is centered toggle switch.
13. In the upper-right corner of the window, click the Save button.

    If you change the learning parameters for a previously trained element, you have to confirm the changes.

14. In the information block located above the training settings, click the Train element button.

After the training is complete, you can view the training results of an ML model element in the Training results tab.

After all predictive elements and elliptic envelope-based elements that are part of the ML model have been successfully trained, the model will be assigned a status of Trained. If required, you can retrain the ML model element by clicking Restart training.