Kaspersky KICS 5.0 Uses Machine Learning to Classify OT Devices and Flag Anomalies
Summary
Kaspersky’s MLEP in KICS for Networks 5.0 uses recurring network behavior to refine OT device categories and alert on anomalies. Its aggregated events cannot reconstruct packet order or command contents, and results depend on traffic visibility.
Key points
- Machine Learning Event Processor (MLEP) analyzes network behavior to refine device categories and flag anomalies in Kaspersky Industrial CyberSecurity for Networks 5.0.
- MLEP represents traffic as 15-second event fragments containing endpoints, direction, protocol, and packet counts and sizes; it cannot reconstruct packet order or command contents.
- A spiking neural semantic network processes event streams through attention heads and monitors configured for particular scenarios.
- For categorization, MLEP compares recurring behavior with known assets and suggests categories for similar devices; prediction quality depends on observed traffic.
- Six preconfigured monitors flag new external hosts, new destination-and-port combinations, unusually large data transfers, atypical activity times, new protocols, and scanning-like activity.
- Anomaly alerts help analysts investigate changes in context; they do not by themselves establish that activity is malicious.
Article Details
- Event Type
- Kaspersky described the machine-learning-based Machine Learning Event Processor (MLEP), included in Kaspersky Industrial CyberSecurity for Networks 5.0, for device categorization and network anomaly detection.
- Impact
- MLEP analyzes aggregated network events to help classify devices from recurring behavior and flag deviations such as new external connections, unusual data volumes, atypical activity times, new protocols, and possible scanning. These alerts can guide incident investigations and help reconstruct activity timelines. The article notes that results depend on traffic visibility and that aggregated events cannot reconstruct packet order or command content.