ABS AI engine can be trained in a live environment by analyzing ASE access logs to build its model.
When ABS first receives traffic for a new API, the training period starts. After the defined training period (default is 24 hours) expires, ABS checks if sufficient training data has been collected and will continue training until the models are ready for attack detection. ABS applies continuous learning and adapts its model over time for increased accuracy.
For example, a new API ecosystem is added with four APIs, and ABS is configured with a 24-hour training period. Two APIs have immediate API activity, so ABS begins the training period for both APIs. After 24 hours, ABS will detect attacks only for the two trained APIs.
If the remaining two APIs start sending traffic three days later, then ABS will begin the 24-hour training period for the remaining APIs and begin attack detection for those APIs at the end of the training period.
It is important to decide on the training and threshold update intervals prior to starting the AI system. Although you can update the training and threshold periods, it is a good practice not to change these variables frequently as this may lead to a change in the behavior of the AI model.