Kaspersky details machine learning for tracking OT network behaviour

Kaspersky’s SecureList feature outlines MLEP in KICS for Networks 5.0, the machine-learning-based event processor designed to track OT device network behaviour. Developed to address gaps in asset inventories and the Living-off-the-Land techniques used in industrial networks, MLEP refines device categories and detects anomalies by analysing patterns in recurring network interactions.

Rather than recording every packet, MLEP represents traffic as 15-second fragments called events, each containing endpoints, direction, protocol, and packet counts. A device’s behavioural history is built from these events, enabling comparison across hosts and helping identify when a device deviates from its normal profile. The article notes that history is kept per device and only temporarily stored within an episode of up to 30,000 aggregated events by default.

MLEP operates on a spiking neural semantic network (NSN), using neurosemantic layers, attention heads and monitors to process event streams in real time. Event identification creates neurons for parameters and for the event as a whole; neurogenesis adds new neurons for previously unseen events. Attention heads filter streams, while monitors detect anomalies or category shifts.

The system ships with preconfigured heads and monitors and supports various anomaly scenarios, including new external hosts, new destination/port pairs, unusually large data volumes, atypical activity times, new protocols, and activity suggesting scanning. In practice, MLEP helps complete asset inventories by linking uncategorised devices to known categories based on similar network behaviours, and by providing anomaly-driven timelines to assist investigations.

The article cites CISA’s 2025 OT asset inventory guidance and the SANS 2025 ICS security survey to frame the importance of enhanced visibility, with Ezhov and Lavrentyev presenting the technology for KICS 5.0.