Advanced API Security 會持續監控 API，保護 API 免於遭受安全威脅，包括惡意用戶端的攻擊和濫用行為。Advanced API Security 會分析 API 流量，找出可疑的 API 要求，並提供工具讓您封鎖或標記這些要求。此外，Advanced API Security 會評估 API 設定，確保符合安全性標準，並在必要時提供改善建議。
進階 API 安全性不會影響執行階段流量。
下圖說明先進 API 安全性的運作方式。
Advanced API Security 會使用下列程序保護 API：
進階 API 安全性會收集透過 API 傳送的近期流量資料。
Advanced API Security 會分析資料，偵測異常的流量模式，指出 API 遭到威脅。
設定模糊處理時，Advanced API Security 會在模糊處理前執行濫用偵測和安全性動作等檢查。舉例來說，即使 IP 位址經過模糊處理，系統仍可偵測特定 IP 位址的濫用行為。不過，使用者無法在進階 API 安全性 UI 或 API 中，以明文 (未經雜湊處理) 形式查看經過模糊處理的值 (例如用戶端 IP 位址)。系統會顯示經雜湊處理的值。
在某些情況下，您需要取得未經模糊處理的資料值，才能搭配進階 API 安全性功能使用。舉例來說，您可能需要用戶端 IP 位址才能設定安全性動作。如果值已模糊處理，您就無法擷取明文 IP 位址。由於資料模糊處理使用單向雜湊，而進階 API 安全性無法將雜湊值轉換回明文值，因此在安全性動作設定中使用模糊處理 (雜湊) 值無法運作。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-18 (世界標準時間)。"],[[["\u003cp\u003eAdvanced API Security is a paid add-on for Apigee and Apigee hybrid that protects APIs from security threats by monitoring traffic, identifying suspicious requests, and evaluating API configurations.\u003c/p\u003e\n"],["\u003cp\u003eTo utilize Advanced API Security, users must first provision Apigee and then enable the feature, which is available for Apigee Subscription, Pay-as-you-go, and hybrid Subscription organizations, as well as non-hybrid organizations with data residency enabled.\u003c/p\u003e\n"],["\u003cp\u003eAdvanced API Security presents its analysis of API traffic in the Apigee UI through Abuse detection, Security reports, and Risk assessment, allowing users to review and take actions.\u003c/p\u003e\n"],["\u003cp\u003eUsers can define how Apigee handles detected threats through Security actions, like blocking requests, and can set up Security alerts to receive notifications about security-related events.\u003c/p\u003e\n"],["\u003cp\u003eAdvanced API Security uses detection rules based on machine-learning algorithms to detect patterns of malicious activity, allowing for counter-measures to be put in place.\u003c/p\u003e\n"]]],[],null,["# Overview of Advanced API Security\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\n| **Note:** To use Advanced API Security you must first [provision Apigee](/apigee/docs/api-platform/get-started/provisioning-intro). When Apigee is successfully provisioned, you can [set up and enable Advanced API Security](./enable-security).\n\nAdvanced API Security continually monitors your APIs to protect them from security threats,\nincluding attacks from malicious clients and abuse. Advanced API Security analyzes your API traffic to\nidentify suspicious API requests, and provides tools to block or flag those requests\nif you decide to do so. In addition, Advanced API Security evaluates your API configurations to\nensure they meet security standards, and gives you recommendations for improving them if\nneeded.\n\nAdvanced API Security does not affect runtime traffic.\n\nThe diagram below illustrates how Advanced API Security works.\n\nAdvanced API Security uses the following process to protect your APIs:\n\n1. Advanced API Security collects data for recent traffic passing through your APIs.\n2. Advanced API Security analyzes the data to detect unusual traffic patterns that indicate a threat to your APIs.\n3. Advanced API Security presents the results of the analysis in following pages in the Apigee UI:\n - [Abuse detection](#abuse-detection)\n - [Security reports](#security-reports)\n - [Risk assessment](#risk-assessment)\n4. After reviewing the analysis, you can choose to block or flag requests from specific IP addresses using the [security actions](#security-actions) page. You can also create [security alerts](#security-alerts), which notify you of events related to Advanced API Security.\n\nNote that Advanced API Security does not support APIs running under\n[Apigee Adapter for Envoy](/apigee/docs/api-platform/envoy-adapter).\n\nUse Advanced API Security\n-------------------------\n\nAdvanced API Security is available as a paid add-on for the following organization types:\n\n- Apigee Subscription and Pay-as-you-go organizations\n- Apigee hybrid organizations\n- Apigee organizations with [data residency enabled.](/apigee/docs/api-platform/get-started/drz-concepts) See [Data residency and Apigee hybrid](/apigee/docs/api-platform/get-started/drz-concepts#data-residency-and-apigee-hybrid) for information on use with DRZ-enabled hybrid organizations.\n\nTo use Advanced API Security, you must first enable it, as described in the following sections:\n\n- [Manage Advanced API Security for Pay-as-you-go organizations](/apigee/docs/api-security/enable-security#manage-advanced-api-security-for-pay-as-you-go-organizations)\n- [Manage Advanced API Security for Subscription organizations](/apigee/docs/api-security/enable-security#manage-advanced-api-security-for-subscription-organizations)\n\nYou can try Advanced API Security for free in any trial organization. Contact [Apigee Sales](https://pages.apigee.com/contact-sales-reg.html) to learn more.\n\nAdvanced API Security features\n------------------------------\n\nThe following sections briefly describe the features of Advanced API Security.\n\n### Abuse detection\n\n[Abuse\ndetection](/apigee/docs/api-security/abuse-detection) shows you security incidents involving your APIs. A security incident is a group\nof detected security events that are related to each other. Advanced API Security uses\n[detection rules](/apigee/docs/api-security/detection-rules), based on\nGoogle's machine-learning algorithms, to identify patterns that are signs of malicious activity,\nincluding API scraping and anomalies. You can then take measures to counter those threats\nusing [security actions](#security-actions).\n\n### Security reports\n\n[Security reports](/apigee/docs/api-security/security-report-jobs) give you more in-depth analysis of security threats to your APIs.\nFor example, you can create reports for the number of malicious requests\nby various dimensions, such as the country of origin of the request. You can view these\nreports in the Apigee UI or via the API.\n\n### Risk assessment\n\n[Risk assessment](/apigee/docs/api-security/security-scores) helps you identify APIs\nthat don't conform to security standards. Risk assessment regularly evaluates your API configurations\nand calculates scores to rate their security level. When a low score indicates a configuration\nissue, Advanced API Security provides recommendations to resolve the problem.\n\n### Security actions\n\n[Security actions](/apigee/docs/api-security/security-actions) let you\ndefine how Apigee handles detected traffic, based on information from the Abuse detection page.\nFor example, you can create a security action to deny requests from an IP address that has been\nidentified as a source of abuse.\n\n### Security alerts\n\nYou can configure [security alerts](/apigee/docs/api-security/security-alerts)\nto send you notifications when Advanced API Security detects\nevents related to Advanced API Security, such as changes to your security scores or security incidents.\n\nData obfuscation with Advanced API Security\n-------------------------------------------\n\nAdvanced API Security works with data that is obfuscated to replace sensitive data with a hashed value. See\n[Obfuscate user data for Apigee API Analytics](/apigee/docs/api-platform/analytics/obfuscate-user-data-for-analytics)\nfor information on the data obfuscation functionality.\n\n\nWhen obfuscation is configured, Advanced API Security checks such as in [Abuse detection](#abuse-detection)\nand [Security actions](#security-actions) are applied before the obfuscation. For example,\nit's possible to detect abuse from a specific IP address even if the IP address is obfuscated. However,\nobfuscated values (such as client IP address) are not viewable to users in clear (unhashed) text within the\nAdvanced API Security UIs or APIs. The hashed values are shown.\n\n\nIn some cases you need to obtain an unobfuscated data value to use with Advanced API Security. For example,\nyou might need a client IP address to configure a Security action. If the value is already obfuscated, you\ncan't retrieve the clear text IP address. Using the obfuscated (hashed) value in the Security action\nconfiguration doesn't work since data obfuscation uses a one-way hash and Advanced API Security cannot\nconvert the hashed value back to the clear text value."]]
