Kaspersky Machine Learning for Anomaly Detection

Viewing ML model element parameters

Expand all | Collapse all

To view the parameters of an ML model element:

  1. In the main menu, select the Models section.
  2. Click the vertical menu  next to the ML model whose data you need to view, and select Model details.

    The <ML model name> pane opens on the right showing detailed information on the ML model.

  3. To view the parameters of an ML model element, select the Model elements tab and click the down arrow () next to the relevant ML model element.

    The <Model name> pane displays a list of the ML model element.parameters.

A list of ML model element parameters and their descriptions are provided in the table below.

ML model element parameters

ML model element parameters

Description of ML model element parameters

ID

Automatically assigned short identifier of the ML model element.

Element name

Name of the ML model element. This parameter can be edited.

UUID

Automatically assigned full identifier of the ML model element.

element_path

Path to the ML model element.

block_type

Type of ML model element (for example, neural_forecaster – predictive neural network or rule).

color

Color to display the ML model element and indicator points of the incidents registered by the ML model element on the graphs in the Monitoring and History sections. This parameter can be edited.

alpha

Parameter for smoothing the cumulative MSE (for an ML model based on the Forecaster detector) or parameter for smoothing the anomaly detection probability (for a model based on the XGBoost detector). This parameter can be edited.

delta_t

Parameter that determines the step of the time grid (in nanoseconds). The ML model works with data calculated on a uniform temporal grid. Conversion of the received telemetry data to a uniform temporal grid is performed automatically.

tag_ids

List of tag identifiers included in the ML model element.

Details on the tag_ids parameter.

in_tags

List of tags that serve as input data for predicting the values of the output tags (out_tags).

indicator_tags

List of output indicator tags included in the ML model element. This parameter is available only in the list of parameters of the ML model based on the Rule Detector.

input_window_size

Input interval of observations measured by the number of steps of the time grid (size of the input window).

Details on the input_window_size parameter.

power

Power indicator of the cumulative forecast error (MSE). This parameter can be edited and is available only in the list of parameters of the ML model based on the Forecaster detector.

threshold

Threshold value for an incident registration. This parameter is available only in the list of parameters of the ML model based on the Forecaster detector.

Details on the threshold parameter.

batch_size

Number of input windows processed by the ML model element in one pass during training. This parameter is available only in the list of parameters of the ML model based on the Forecaster detector.

forecast_shift

Offset of the forecast window forecast_window_size relative to the start of the input window input_window_size (in time grid steps).

forecast_window_size

Size of the output window for which the ML model element determines the values of the output tags out_tags based on the input tags in_tags in the input window input_window_size. The output window size is specified as the number of time grid steps.

out_tags and mse_weights

List of output tags and their relative weights. The values of output tags are predicted by the ML model and then compared with the actual values. This parameter can be edited and is available only in the list of parameters of the ML model based on the Forecaster detector.

Details on the out_tags and mse_weights parameters.

mode

MSE calculating method used by the Anomaly Detector service. This parameter is available only in the list of parameters of the ML model based on the Forecaster detector.

Details on the mode parameter.

In neural network ML models, the cumulative prediction error denoted by the MSE parameter in the application web interface is usually calculated with exponential smoothing, as the sum of the instantaneous prediction errors at the current and previous points, and the contribution of a point lagging k steps behind decreases with the coefficient (1-alpha)^k. The cumulative error is calculated as the power-th root of the mse_weights-weighted sum of the individual instantaneous prediction errors for each output tag to the specified power. The MSE value is calculated without smoothing when the alpha parameter is set to 1.