“50% of respondents had deployed or significantly expanded ICS inventory and visibility tools over the previous 12 months,” according to the SANS 2025 ICS security survey — a striking metric that frames why Kaspersky’s new Machine Learning Event Processor (MLEP) matters for industrial networks.
Asset Discovery and the practical challenge of incomplete inventories
Kaspersky Industrial CyberSecurity for Networks (KICS) uses Asset Discovery as the foundation of visibility: passive traffic analysis detects devices and their interactions, and recognition rules extract vendor, model, or software version where possible. Where polling is permitted, active polling modules (APMs) can request additional configuration and firmware details. Even so, the product documentation describes persistent gaps: some devices reveal identifying information only at startup, others rarely communicate, proprietary protocols or encryption can leave only metadata, and monitoring may miss traffic from some network segments. Those gaps leave many hosts listed only by IP address and make role-based inventorying — engineering workstation, process data server, contractor equipment — hard to complete from signatures alone.
How MLEP represents network traffic: 15‑second fragments and events
MLEP does not model every packet. Instead, it aggregates sessions into 15‑second fragments and groups those fragments into events. Each event stores endpoint identifiers (IP, MAC, port), direction, protocol, and counts and sizes of packets, then receives a timestamp. Events feed a behavioral history for each object; histories are held temporarily within an episode (30,000 aggregated events by default) to conserve compute resources. That aggregation prevents reconstruction of exact packet order or command content, but MLEP’s designers argue the metadata is sufficient to compare stable connections and changes in exchange volume across devices.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleThe neurosemantic network: attention heads, monitors, and spiking nodes
MLEP is built on a spiking neural semantic network (NSN). Unique parameter values become neurons in layer 0; whole events become neurons in layer 1. If an event appears for the first time, neurogenesis creates a new neuron; repeat occurrences reactivate that neuron and update basic statistics such as last activation time and total activations. Layer 2 and above store sequences and recurring patterns. Specialized listener neurons on layer −1 drive attention heads and monitors: attention heads subscribe to streams of neurons that match configured queries and emit spikes when subscribed neurons activate. Monitors then accumulate and process those spikes, applying post‑filters or statistical checks.
From behavior to inventory refinement and anomaly alerts
MLEP uses attention heads and monitors in two linked ways. For categorization, MLEP identifies groups of devices that share recurring network features and extends known categories from Asset Discovery to uncategorized hosts that match those behaviors. A device may be placed in multiple groups; MLEP makes a weighted assessment across groups and verifies proposed categories against metadata and rule monitors loaded at startup.
For anomaly detection, the current MLEP ships with six preconfigured monitors, each corresponding to a type of deviation from a device’s usual network profile: new external host; new combination of destination address and port; unusually large volume of data sent; atypical activity time; new protocol; and activity with signs of scanning. Alerts include correlations — which hosts, which protocols, when and how much data — that help investigators reconstruct timelines and find missing links when signature‑based detection shows nothing explicit.
What this means for security teams, procurement and incident responders
- Security teams and analysts: MLEP provides behavioral context where packet content or signatures are missing. The system flags anomalies such as new external connections, atypical hours, or large data exfiltration events, and marks those events with an AI label that shows event name, source, destination, timestamp, and scenario ID.
- Procurement leaders and OT asset managers: the joint OT asset inventory guidance cited in the product documentation treats device inventory and role classification as part of OT asset management; MLEP’s ability to suggest categories can help close gaps where documentation lags or upgrades change equipment faster than records can be updated.
- Incident responders: because MLEP focuses on behavioral changes — who spoke to whom, when, and how much — its timeline of anomalies can reveal reconnaissance, new service use, and data transfers even when attackers rely on legitimate protocols and Living‑off‑the‑Land techniques.
Machine learning in KICS 5.0 does not replace packet inspection or asset polling; it augments them. By compressing traffic into events, using a neurosemantic graph to recognize recurring patterns, and surfacing six anomaly types out of continuous streams, MLEP turns a roster of IP addresses into a contextual map of device roles and atypical behavior — a capability the product’s authors present as complementary to existing signature and protocol analysis. Whether that additional context will materially shorten detection timelines or prevent compromise depends on visibility of traffic, the effectiveness of APMs where permitted, and how teams use the AI‑labeled events during investigations.
Source: https://securelist.com/tr/machine-learning-event-processor-in-kics-for-networks/121794/
