AI Technology Research

• • Statistical threat detection: Analyzes global statistical data on suspicious activities and threats to detect anomalies, with insights shared across all KSN participants.
• • Statiс threat detection: Uses deep learning for feature analysis and machine learning to create locality‑sensitive mappings, detecting unknown threats based on structural similarities.
• • Behavioral threat detection: Identifies malicious activities by analyzing behavioral anomalies, learning from anonymized global execution telemetry to detect even the most sophisicated obfuscated malware.

Cuts through alert noise and detects suspicious activities

• • MDR Auto-Analyst: Resolves up to 25% of alerts in Kaspersky MDR SOC by ruling out everything not characteristic of malicious activity
• • AI-based alert prioritization: Models «normal» host activity and prioritizes alerts that involve anomalous activity
• • DLL hijacking detection: baselines DLL loading behavior using global anonymized telemetry and flags anomalous load patterns.
• • Compromised account detection: continuously learns normal account behavior and surfaces suspicious events as actionable alerts.

Accelerates insight extraction: deobfuscating scripts, generating summaries, and enabling natural‑language queries

• • Alert/incidents summaries: produces an easy-to-grasp summary of all information assembled in the incident card
• • Command string explanation: deciphers what a complex, obfuscated command line / script does.
• • Natural language querying: Lets build complex search queries using plain language — speeding up workflows and lowering the skill barrier for security analysts.
• • AI container image analysis: Find errors and misconfigurations and produces additional insights

Makes work with TI data faster, easier and more effective

• • AI OSINT data summaries: AI-based summarization converts human-readable threat intelligence into concise findings, essential context and actionable insights, enabling faster decision-making and response.
• • Flexible LLM integration with threat intelligence: Connect any model you use via the MCP protocol, giving SecOps teams access to Kaspersky’s extensive threat intelligence data for AI-assisted analysis and investigation.

• • Machine Learning for Anomaly Detection: detects deviations in industrial processes and IT/OT event streams early, monitoring multiple parameters simultaneously before issues become critical.
• • Arbitrary LLM usage with TI: leverages spiking neural networks and the specialized neuromorphic chips to deliver low‑power, high‑efficiency AI and security for cyber‑physical systems at the edge.