ABS AI engine can be trained in a live environment by analyzing ASE access logs to build its model. When ABS first receives traffic for a new API, the training period starts. After the defined training period (default is 24-hours) expires, ABS checks if sufficient training data has been collected and will continue training until the models are ready for attack detection. ABS applies continuous learning and adapts its model over time for increased accuracy.
For example, a new API ecosystem is added with four APIs, and ABS is configured with a 24-hour training period. Two APIs have immediate API activity, so ABS begins the training period for both APIs. After 24-hours, ABS will detect attacks only for the two trained APIs.
If the remaining two APIs start sending traffic three days later, then ABS will begin the 24-hour training period for the remaining APIs and begin attack detection for those APIs at the end of the training period.