Kaspersky Machine Learning for Anomaly Detection

Training an ML model

Kaspersky MLAD lets you clone an existing ML model built with a Forecaster detector in order to retrain it or perform additional training based on new telemetry data obtained by Kaspersky MLAD for a specific monitored asset.

Training an ML model is a resource-consuming process. Depending on the model complexity and the amount of data, the main Kaspersky MLAD services (data reception, anomaly detection, web interface operation) may slow down. To clarify the rules for training the ML model, it is recommended to consult with Kaspersky experts or a certified integrator.

To train an ML model:

1. In the main menu, select the Models section.
2. In the Action column, click the Train button located next to the ML model that you want to use as the base for training the new ML model.

   The Model cloning and training pane opens on the right.

3. If necessary, enter a name for the new ML model in the New model name field.

   By default, a new ML model is assigned a name in the following format: <original model name>_Cloned&Retrained_<date and time>.

4. In the Start of the data export period field, click the Calendar icon () and select the start date and time of the data export period for training the model.
5. In the End of the data export period field, click the Calendar icon () and select the end date and time of the data export period for training the model.
6. Expand the Additional settings list by clicking the right arrow (), and, if necessary, specify values for the following settings:
   • In the Number of training epochs field, specify the number of training epochs.

     Kaspersky MLAD can finish training the ML model before the specified number of epochs is reached, if it considers that the ML model is trained. The default number is 10000 training epochs.

   • To limit the time for training the model, enable the Limit the model training time option and fill in the following fields:
     • In the Days field, specify the number of days to train the ML model.
     • In the Hours field, specify the number of hours to train the ML model.
   • Perform one of the following actions:
     • If you want to load the relative weights of the output tags of a previously trained ML model, enable the Load the pre-training state of the original model option.
     • If you want to retrain the ML model, disable the Load the pre-training state of the original model option.

     This option is disabled by default.

   • In the Error resolution window field, specify an MSE smoothing interval (alpha parameter).

     By default, this interval is equal to the forecast window size forecast_window_size. If MSE smoothing is not required, enter 0 in the Error resolution window field.

     Only Kaspersky experts or a certified integrator can change the error smoothing interval.

7. Click the Clone and train button.

After training, the new ML model will appear in the models table.