Update the training variables

API Behavioral Security (ABS) provides an update.sh script in the /pingidentity/abs/util directory to update the training related variables.

Using the script, you can update the following variables:

Name Variable

Name	Variable
Continuous learning	`continuous_learning`
Training period	`attack_initial_learning`
Threshold update period	`attack_update_interval`
Window length	`window_length`

Continuous learning

continuous_learning

Training period

attack_initial_learning

Threshold update period

attack_update_interval

Window length

window_length

You can update the training period when the system is already in a running state by using the script. Review the following use cases before changing the training and threshold period.

In all the use cases, the default training period is assumed to be 24-hours. If you want to extend the training period, best practice is to add new application programming interface (API)s after the training period is adjusted to avoid APIs completing a shorter training period.

You can also use Global Configuration REST API to update the training variables. For more information, see Global configuration update REST API.

Update the training interval

Increase the training period

You can increase the training period by running the update.sh script.

Case	System behavior
The API model is under training, that is, the training period is not over.	In this case, if you increase the training period, for example, from 24 hours to 48 hours, the AI model trains based on the updated training period.
The API model has completed the training process.	Increasing the training period has no effect on trained APIs. Any new APIs will use the new training period.

Case

System behavior

The API model is under training, that is, the training period is not over.

In this case, if you increase the training period, for example, from 24 hours to 48 hours, the AI model trains based on the updated training period.

The API model has completed the training process.

Increasing the training period has no effect on trained APIs. Any new APIs will use the new training period.

Decrease the training period

You can decrease the training period by running the update.sh script.

Case	System behavior
The API model is in the training process but has not reached the duration of the new training period.	Decreasing the training period (for example, from 24 hours to 12 hours) shortens the training period to 12 hours for the APIs that have not completed the training process. If the API has completed 10 hours of training, then it will now complete its training period after 2 more hours.
The API model is in the training process and the new training duration is less than the current AI model trained duration.	In this case, the API model stops training itself at the current time and moves to the prediction mode. For example, if the original training period was 24 hours and the AI model has been trained for 18 hours, at this time, if the training period is reduced to 12 hours, the AI model stops training itself and moves to the prediction mode.
API model has completed the training process.	Decreasing the training period has no effect on trained APIs. Any new APIs will use the new training period.

Case

System behavior

The API model is in the training process but has not reached the duration of the new training period.

Decreasing the training period (for example, from 24 hours to 12 hours) shortens the training period to 12 hours for the APIs that have not completed the training process. If the API has completed 10 hours of training, then it will now complete its training period after 2 more hours.

The API model is in the training process and the new training duration is less than the current AI model trained duration.

In this case, the API model stops training itself at the current time and moves to the prediction mode.

For example, if the original training period was 24 hours and the AI model has been trained for 18 hours, at this time, if the training period is reduced to 12 hours, the AI model stops training itself and moves to the prediction mode.

API model has completed the training process.

Decreasing the training period has no effect on trained APIs. Any new APIs will use the new training period.

Running the `update.sh` script

About this task

To run the update.sh script:

Steps

Copy the update.sh script from the util directory to your MongoDB primary node.

You can find the script in the /opt/pingidentity/abs/util directory.

Access script help by logging into the MongoDB primary machine and running the following command:

/opt/pingidentity/mongo/update.sh help

Example:

For example, change the training period to 48 hours:

/opt/pingidentity/mongo/update.sh -u absuser -p abs123 --attack_initial_training 48
updating training_period to 48
WriteResult({ "nMatched" : 1, "nUpserted" : 0, "nModified" : 1 })
The current values of the variables are:
attack_initial_training=48
attack_update_interval=24
api_discovery=false
discovery_update_interval=1
continuous_learning=true
discovery_initial_period=24
url_limit=100
response_size=100
window_length=24
discovery_subpath=3
percentage_diskusage_limit=80

Global Config successfully updated

After running the script, stop and start all ABS nodes for the updated values to take effect.

You can change the training period and threshold simultaneously or individually.

PingIntelligence