Working with imported ML models

This section provides information about working with imported ML models and their elements.

The functionality is available after a license key is added.

ML models can be provided by Kaspersky specialists or certified integrators within the Kaspersky MLAD Model-building and Deployment Service. Such ML model must be imported to Kaspersky MLAD and activated. You cannot create new elements for an imported ML model, or delete existing elements.

Upon importing into Kaspersky MLAD the ML model is already trained. You can train the predictive elements and elliptic envelope-based elements as part of the imported ML model before running inference and/or publishing it.

ML model importing

If the ML model was created by Kaspersky specialists or a certified integrator, you can import this ML model into Kaspersky MLAD.

Kaspersky MLAD may slow down its operation when importing an ML model whose size exceeds 1 GB.

System administrators and users who have the Upload models permission from the Manage ML models group of rights can import ML models. The functionality is available after a license key is added.

To import an ML model:

1. In the main menu, select the Models section.
2. In the asset tree, next to the name of the asset for which the ML model is to be imported, open the vertical menu and select Import model.
3. In the opened window, select the ML model file.

   An ML model file is provided as a TAR archive with a maximum size of 1.5 GB.

The ML model will be imported to Kaspersky MLAD. The new ML model displays in the Models group of the asset tree. The Models group is created automatically and displayed as part of the selected section of the asset tree. If the imported ML model contains predictive elements, elliptic envelope-based elements, and/or diagnostic rule-based elements, the Models group will display the Predictive elements, Elliptic envelopes, and/or Rules subgroups, respectively.

After being imported, the ML model is assigned the Not activated status. The ML model must be activated. If you import an ML model that was previously activated and then deleted, you do not need to reactivate the ML model.

Activating an imported ML model

After an ML model prepared by Kaspersky specialists or a certified integrator has been imported into Kaspersky MLAD, it must be activated.

If the ML model activation code is lost, send a request to Kaspersky to receive a new code.

System administrators and users who have the Activate models permission from the Manage ML models group of rights can activate imported ML models. The functionality is available after a license key is added.

To activate an imported ML model:

1. In the main menu, select the Models section.
2. In the asset tree, select the imported ML model.

   The details area appears on the right.

3. In the Model activation code field, enter the code received from Kaspersky personnel, and click the Activate button in the upper right part of the window.

ML model is activated. It will be assigned the Trained status. If necessary, you can train the ML model again. For example, you can train it again on new data.

You can to start ML model inference to begin the analysis of telemetry data received from the monitored asset.

Changing the parameters of an element of an imported ML model

You can change some parameters of an element of an imported ML model.

Parameters cannot be changed if the ML model is assigned the Ready for publication or Published status.

System administrators and users who have the Edit untrained models permission from the Manage ML models group of rights can edit the settings of elements of imported ML models. The functionality is available after a license key is added.

To change the parameters of an imported ML model element:

1. In the main menu, select the Models section.
2. In the asset tree, select the ML model element that you want to change.

   A list of options appears on the right.

3. In the upper-right corner of the window, click the Edit button.
4. Adjust the following element settings, if needed:
   • Name and description of the ML model element
   • Reminder period

     This parameter is unavailable for editing if the ML model is in the Historical inference in progress or Streaming inference in progress state.

     Modifying this setting changes anomaly detection sensitivity.

   • Period of recurring alert suppression

     This parameter is unavailable for editing if the ML model is in the Historical inference in progress or Streaming inference in progress state.

     Modifying this setting changes anomaly detection sensitivity.

   • Anomaly observation period

     This parameter is unavailable for editing if the ML model is in the Historical inference in progress or Streaming inference in progress state.

     Modifying this setting changes anomaly detection sensitivity.

   • Anomaly duration share in interval

     This parameter is unavailable for editing if the ML model is in the Historical inference in progress or Streaming inference in progress state.

     Modifying this setting changes anomaly detection sensitivity.

   • Color of incident dot indicators
   • Incident status and cause
   • Detection threshold

     This parameter is unavailable for editing if the ML model is in the Historical inference in progress or Streaming inference in progress state.

     The detection threshold value was set after training an element of the imported ML model. Modifying this setting changes anomaly detection sensitivity.

   • Expert opinion
5. In the upper-right corner of the window, click the Save button.