Kaspersky Machine Learning for Anomaly Detection

Adding a neural network element to an ML model

December 6, 2023

ID 256033

System administrators and users who have the Create models permission from the Manage ML models group of rights can add ML model elements.

To add a neural network element to an ML model:

  1. In the main menu, select the Models section.
  2. In the asset tree, next to the Neural networks group within the ML model to which you want to add a neural network element, open the vertical menu and select Create element.

    A list of options appears on the right.

  3. In the Name field, specify the name of the ML model element.
  4. Enter a description for the ML model element in the Description field.
  5. In the General element settings settings block, do the following:
    1. In the Reminder period (sec) field, specify the period in seconds, upon reaching which the ML model will generate a repeated incident if anomalous behavior is retained in each UTG node.

      The default value of this setting is 0, which corresponds to no reminders.

    2. In the Period of recurring alert suppression (sec) field, specify the period in seconds during which the ML model does not log repeated incidents for the same element.

      The default value of this setting is 0 (repeat incidents not suppressed).

    3. In the Grid step (sec) field, specify the element's UTG period in seconds expressed as a decimal.
    4. In the Incident status drop-down list, select a status to be automatically assigned to incidents logged by the ML model element.
    5. In the Incident cause drop-down list, select the cause to be automatically set for incidents logged by the ML model element.
    6. In the Color of incident dot indicators field, select the color of the indicator points of the incidents logged by the ML model element on the graphs in the Monitoring and History sections.
    7. In the Detection threshold field, specify a prediction error threshold value upon reaching which an incident is logged.
    8. In the Expert opinion field, specify the expert opinion to be automatically created for incidents logged by the ML model element.
  6. Select one of the following ML model neural network element architectures: Dense, RNN, CNN, TCN, or Transformer.
  7. If you need to specify the architecture parameters of a neural network element and the power exponent and smoothing value of the cumulative prediction error, use the toggle switch to enable Advanced neural network settings.
  8. In the Main settings block, do the following:
    1. In the Input tags drop-down list, select one or more tags that serve as the source data for predicting the values of the output tags.

    2. In the Output tags drop-down list, select one or several tags whose behavior is predicted by the model element.

    3. If extended setup mode is enabled, use the MSE power exponent field to specify the cumulative prediction error power exponent in decimal format.
    4. If extended setup mode is enabled, use the Smoothing factor field to specify the cumulative prediction error smoothing value in decimal format.
  9. In the Window settings settings block, do the following:
    1. In the Input window (steps) field, specify the size of the input value window, from which the ML model element predicts the output values.
    2. In the Output window offset field, specify the number of steps by which the beginning of the output window will be shifted relative to the beginning of the input window.
    3. In the Output window (steps) field, specify an output tag prediction length calculated from the input tags on the input window.
  10. If you are adding a neural network element with a dense architecture, do the following:
    1. In the Multipliers for calculating number of neurons per layer field, provide the factors, separated by a comma without spaces, by which to multiply the number of input tags to calculate the number of neurons per layer of the ML model element.
    2. In the Activation function per layer field, specify one of the following activation functions on each layer of an ML model element separated by a comma without spaces:
      • relu: A non-linear activation function that converts an input value to a value between 0 and positive infinity.
      • selu: A monotonically increasing function that enables normalization based on the central limit theorem.
      • linear: A linear function that is a straight line proportional to the input data.
      • sigmoid: A non-linear function that converts input values to values between 0 and 1.
      • tanh: A hyperbolic tangent function that converts input values to values between -1 and 1.
      • softmax: A function that converts a vector of values to a probability distribution that adds up to 1.

      The default value of this setting is relu,relu,relu.

  11. If you are adding a neural network element with an RNN architecture, do the following:
    1. In the GRU neurons per layer field, specify the number of GRU neurons on layers separated by a comma without spaces.

      The default value of this parameter is 40,40.

    2. In the Number of neurons in TimeDistributed layer field, specify the number of neurons distributed in time on the layers of the decoder separated by a comma without spaces.

      The default value of this parameter is 40,20.

  12. If you are adding a neural network element with an CNN architecture, do the following:
    1. In the Filter size per layer field, specify the size of the filters for each layer of the element separated by a comma without spaces.

      The default value of this parameter is 2,2,2.

    2. In the Filters per layer field, specify the number of filters for each layer of the ML model element separated by a comma without spaces.

      The default value of this parameter is 50,50,50.

    3. In the MaxPooling window size per layer field, specify the maximum sampling window size on each layer separated by a comma without spaces.

      The default value of this parameter is 2,2,2.

    4. In the Number of neurons in decoder field, specify the number of neurons on the layers of the decoder.

  13. If you are adding a neural network element with an TCN architecture, do the following:
    1. In the Regularization field, specify the regularization coefficient in decimal format to prevent overfitting of the ML model element.

      The default value of this parameter is 0.1.

    2. In the Size of filters field, specify the size of the filters for the ML model element.

      The default value of this parameter is 2.

    3. In the Dilation per layer field, specify the exponential expansion values of the output data on the layers as a comma-separated list.

      The default value of this parameter is 1,2,4.

    4. In the Activation function drop-down list, select one of the following activation functions:
      • linear: A linear activation function whose result is proportional to the input value.
      • relu: A non-linear activation function that converts an input value to a value between zero and positive infinity. If the input value is less than or equal to zero, the function returns a value of zero; otherwise, the function returns the input value.

      The default value of this parameter is linear.

    5. In the Number of stacks of residual blocks field, specify the number of encoders.

      The default value of this parameter is 1.

    6. In the Decoder layer type field, select one of the following types of layer to precede the output layer:
      • TimeDistributedDense (default): A fully connected architecture layer.
      • GRU: A layer with a recurrent architecture.
  14. If you are adding a neural network element with a transformer architecture, do the following:
    1. In the Encoder regularization field, specify the regularization coefficient in the encoder in decimal format.

      The default value of this parameter is 0.01.

    2. In the Number of attention heads field, specify the number of attention heads.

      The default value of this parameter is 1.

    3. In the Number of encoders field, specify the number of encoders.

      The default value of this parameter is 1.

    4. In the Multipliers for calculating number of neurons per layer field, provide the factors, separated by a comma without spaces, by which to multiply the number of input tags to calculate the number of neurons in the decoding layers.

  15. In the upper-right corner of the window, click the Save button.

The new ML model element will be displayed in the Neural networks group within the selected ML model in the asset tree.

The ML model is assigned the Draft status. Before running inference of an ML model, you must train all of its neural network elements.

Did you find this article helpful?
What can we do better?
Thank you for your feedback! You're helping us improve.
Thank you for your feedback! You're helping us improve.