Anomaly Shield model management page

This page shows the lifecycle of anomaly detection models:

  • The Enforced Model is the model currently used for session evaluation.
  • The Prepared Model is the latest trained model.
  • A prepared model becomes active after it is enforced and the configuration is activated.
  • New models can be created using the Training Task or automatically via retraining.

This configuration page is accessible by clicking on the gears button in the Models column of the Anomaly Shield Application page.

Section – Enforced Model

The enforced model is the model currently used by Airlock Anomaly Shield to evaluate sessions. Model changes take effect when the Airlock Gateway configuration is activated.

GUI

Description

Status

  • OK - All models are trained and usable for evaluation.
    The model will be used after configuration activation.
  • Incomplete – Only some models are usable. This may occur if training data is insufficient or lacks variability.
    The model will be used after configuration activation but may provide reduced detection quality.
  • Empty – No models are usable. The model cannot be used for evaluation.

Training date

Date and time when the model was enforced.

Sessions used in training

The number of sessions used for training.

First session

Date and time of the oldest session that is used in this training.

Last session

Date and time of the newest session that is used in this training.

Buttons

Import
Button to upload a model zip file.

Export
Creates a zip file of the current model for download.

Delete
The model is deleted when the configuration is activated.

Section – Prepared Model

The prepared model is the latest trained model that can be enforced. It becomes active after it is enforced and the configuration is activated.

GUI

Description

Status

  • OK – All models are successfully trained and usable.
  • Incomplete – Only some models are usable. This may occur if training data is insufficient or lacks variability. The model may provide reduced detection quality.
  • Empty – No models are usable.

Training date

Date and time when the model was trained.

Sessions used in training

The number of sessions used for training.

First session

Date and time of the oldest session used for training.

Last session

Date and time of the newest session used for training.

Buttons

Enforce Model
Marks the prepared model as the enforced model so it will be used after configuration activation..

Export
Creates a zip file of the current model for download.

Delete
The model is removed when the configuration is activated.

Section – Training Task

This section defines how models are trained and how model updates are applied.

GUI

Description

Training strategy

Configuration options:

  • Best sessions – Selects a representative subset of sessions from the latest 35-day period using ML heuristics. Recommended for optimal model quality.
  • Best period – Selects the most suitable continuous 35-day period within the available data.
  • All data – Uses all available session data for training.

Automatic retraining

Model retraining checks whether the active model uses the most recent data and retrains if necessary.

Configuration options:

  • Off – Training and enforcement must be performed manually.
  • Retrain only – Models are retrained automatically; enforcement remains manual.
  • Retrain and enforce – Models are retrained and automatically enforced. (Recommended)

Selected sessions

The number of sessions used for this training.

Training data from

Date and time of the oldest session that is used in this training.

Training data to

Date and time of the newest session that is used in this training.

Button

Train
Button to start the configured training.

The button is disabled while training is in progress.

If insufficient data is available, transfer learning is used to generate models. These models improve as more application-specific data becomes available. It is recommended to enable Retrain and enforce to continuously improve model quality.

Section – ColdDB Cluster Sync

Merges ColdDB data from a remote cluster node into the local ColdDB. This can be used to consolidate training data from multiple nodes to improve model training quality.

GUI

Description

Button

Merge remote data
Merges data from a remote cluster node into the local ColdDB.