Threat and Anomaly Detection

Threat and Anomaly Detection is provided by the following parts of the Kaspersky Industrial CyberSecurity for Networks functionality:

Detection of intrusions, attacks, and various anomalies by using Intrusion Detection rules, Intrusion Detection methods based on built-in algorithms, and Network Anomaly Detection rules.
Interaction Control for detecting unauthorized network interactions that do not comply with Network Integrity Control rules.
Deep Packet Inspection (also referred to as Process Control below) for monitoring process parameters in traffic according to process control rules, and for monitoring system commands being sent. You can specify system commands allowed for sending in Interaction Control rules that use Command Control.
Event Monitoring, registered based on various technologies and according to descriptions of attack techniques in the MITRE ATT&CK knowledge base, and which subsequently logs incidents according to Endpoint Detection and Response correlation rules.

For in-depth analysis of industrial network traffic and early detection of anomalies, you can use Kaspersky Machine Learning for Anomaly Detection connectors.