Kaspersky adds ML Event Processor to KICS for Networks 5.0 to classify OT devices and detect anomalies
Kaspersky describes the Machine Learning Event Processor (MLEP), a service in Kaspersky Industrial CyberSecurity for Networks (KICS for Networks) 5.0. It uses machine learning to refine device categories in industrial networks and to flag anomalous network behavior. The article is product and technology news and reports no incident, vulnerability or threat actor. It argues that Living-off-the-Land techniques and legitimate protocols make attacks hard to spot with signatures alone, and that incomplete asset inventories make this worse. It also cites the 2025 CISA joint OT asset inventory guidance and the SANS 2025 ICS survey, in which 50% of respondents had deployed or expanded ICS inventory and visibility tools.
Detalhes técnicos
- MLEP is built on a spiking neural semantic network (NSN). Network sessions are aggregated into events from 15-second fragments, each holding endpoints (IP, MAC, port), direction, protocol, and packet count and size.
- Events are stored as neurons in a layered graph. Attention heads filter the event stream, and monitors (stat monitors, event-count or first-occurrence monitors, and similar-behavior monitors) accumulate and process it. History is kept only per episode (30,000 aggregated events by default).
- For categorization, MLEP groups devices with similar behavior and extends the categories known from Asset Discovery to uncategorized hosts. Rule monitors then check that the assigned category is permissible, using metadata from Asset Discovery and active polling modules (APMs).
- For anomaly detection, the first version ships six preconfigured monitors, one per type of deviation from a device's usual network profile. Anomalies appear in the event list with an AI label.
- Limitations: aggregation prevents reconstructing packet order or command content, and MLEP can only draw conclusions about protocols that another KICS technology already recognizes. Prediction quality depends on how much of the traffic is visible.
Linha do tempo
-
Kaspersky adds ML Event Processor to KICS for Networks 5.0 to classify OT devices and detect anomalies
ler a análise desta fonte ocultar
Kaspersky describes the Machine Learning Event Processor (MLEP), a service in Kaspersky Industrial CyberSecurity for Networks (KICS for Networks) 5.0. It uses machine learning to refine device categories in industrial networks and to flag anomalous network behavior. The article is product and technology news and reports no incident, vulnerability or threat actor. It argues that Living-off-the-Land techniques and legitimate protocols make attacks hard to spot with signatures alone, and that incomplete asset inventories make this worse. It also cites the 2025 CISA joint OT asset inventory guidance and the SANS 2025 ICS survey, in which 50% of respondents had deployed or expanded ICS inventory and visibility tools.
Technical Details
- MLEP is built on a spiking neural semantic network (NSN). Network sessions are aggregated into events from 15-second fragments, each holding endpoints (IP, MAC, port), direction, protocol, and packet count and size.
- Events are stored as neurons in a layered graph. Attention heads filter the event stream, and monitors (stat monitors, event-count or first-occurrence monitors, and similar-behavior monitors) accumulate and process it. History is kept only per episode (30,000 aggregated events by default).
- For categorization, MLEP groups devices with similar behavior and extends the categories known from Asset Discovery to uncategorized hosts. Rule monitors then check that the assigned category is permissible, using metadata from Asset Discovery and active polling modules (APMs).
- For anomaly detection, the first version ships six preconfigured monitors, one per type of deviation from a device's usual network profile. Anomalies appear in the event list with an AI label.
- Limitations: aggregation prevents reconstructing packet order or command content, and MLEP can only draw conclusions about protocols that another KICS technology already recognizes. Prediction quality depends on how much of the traffic is visible.