Advanced API Security 會持續監控 API，防範安全威脅，包括惡意用戶端發動的攻擊和濫用行為。Advanced API Security 會分析 API 流量，找出可疑的 API 請求，並提供工具來封鎖或標記這些請求 (如果決定這麼做)。此外，Advanced API Security 會評估 API 設定是否符合安全標準，並視需要提供改善建議。
進階 API 安全性不會影響執行階段流量。
下圖說明 Advanced API Security 的運作方式。
Advanced API Security 會透過下列程序保護 API：
進階 API 安全性會收集最近透過 API 傳輸的流量資料。
Advanced API Security 會分析資料，偵測出異常的流量模式，指出 API 是否受到威脅。
Advanced API Security 會在 Apigee 使用者介面的下列頁面中顯示分析結果：
設定混淆處理後，系統會在混淆處理前套用 Advanced API Security 檢查，例如「濫用行為偵測」和「安全防護措施」。舉例來說，即使 IP 位址經過混淆處理，系統仍可能偵測到來自特定 IP 位址的濫用行為。不過，在進階 API 安全性使用者介面或 API 中，使用者無法以明文 (未經過雜湊處理) 查看模糊處理的值 (例如用戶端 IP 位址)。系統會顯示雜湊值。
在某些情況下，您需要取得未經過模糊處理的資料值，才能搭配進階 API 安全性使用。舉例來說，您可能需要用戶端 IP 位址來設定安全性動作。如果值已混淆處理，您就無法擷取明文 IP 位址。在安全性動作設定中使用模糊處理 (雜湊) 值無效，因為資料模糊處理會使用單向雜湊，而 Advanced API Security 無法將雜湊值轉換回明文值。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[[["\u003cp\u003eAdvanced API Security is a paid add-on for Apigee and Apigee hybrid that protects APIs from security threats by monitoring traffic, identifying suspicious requests, and evaluating API configurations.\u003c/p\u003e\n"],["\u003cp\u003eTo utilize Advanced API Security, users must first provision Apigee and then enable the feature, which is available for Apigee Subscription, Pay-as-you-go, and hybrid Subscription organizations, as well as non-hybrid organizations with data residency enabled.\u003c/p\u003e\n"],["\u003cp\u003eAdvanced API Security presents its analysis of API traffic in the Apigee UI through Abuse detection, Security reports, and Risk assessment, allowing users to review and take actions.\u003c/p\u003e\n"],["\u003cp\u003eUsers can define how Apigee handles detected threats through Security actions, like blocking requests, and can set up Security alerts to receive notifications about security-related events.\u003c/p\u003e\n"],["\u003cp\u003eAdvanced API Security uses detection rules based on machine-learning algorithms to detect patterns of malicious activity, allowing for counter-measures to be put in place.\u003c/p\u003e\n"]]],[],null,["# Overview of Advanced API Security\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\n| **Note:** To use Advanced API Security you must first [provision Apigee](/apigee/docs/api-platform/get-started/provisioning-intro). When Apigee is successfully provisioned, you can [set up and enable Advanced API Security](./enable-security).\n\nAdvanced API Security continually monitors your APIs to protect them from security threats,\nincluding attacks from malicious clients and abuse. Advanced API Security analyzes your API traffic to\nidentify suspicious API requests, and provides tools to block or flag those requests\nif you decide to do so. In addition, Advanced API Security evaluates your API configurations to\nensure they meet security standards, and gives you recommendations for improving them if\nneeded.\n\nAdvanced API Security does not affect runtime traffic.\n\nThe diagram below illustrates how Advanced API Security works.\n\nAdvanced API Security uses the following process to protect your APIs:\n\n1. Advanced API Security collects data for recent traffic passing through your APIs.\n2. Advanced API Security analyzes the data to detect unusual traffic patterns that indicate a threat to your APIs.\n3. Advanced API Security presents the results of the analysis in following pages in the Apigee UI:\n - [Abuse detection](#abuse-detection)\n - [Security reports](#security-reports)\n - [Risk assessment](#risk-assessment)\n4. After reviewing the analysis, you can choose to block or flag requests from specific IP addresses using the [security actions](#security-actions) page. You can also create [security alerts](#security-alerts), which notify you of events related to Advanced API Security.\n\nNote that Advanced API Security does not support APIs running under\n[Apigee Adapter for Envoy](/apigee/docs/api-platform/envoy-adapter).\n\nUse Advanced API Security\n-------------------------\n\nAdvanced API Security is available as a paid add-on for the following organization types:\n\n- Apigee Subscription and Pay-as-you-go organizations\n- Apigee hybrid organizations\n- Apigee organizations with [data residency enabled.](/apigee/docs/api-platform/get-started/drz-concepts) See [Data residency and Apigee hybrid](/apigee/docs/api-platform/get-started/drz-concepts#data-residency-and-apigee-hybrid) for information on use with DRZ-enabled hybrid organizations.\n\nTo use Advanced API Security, you must first enable it, as described in the following sections:\n\n- [Manage Advanced API Security for Pay-as-you-go organizations](/apigee/docs/api-security/enable-security#manage-advanced-api-security-for-pay-as-you-go-organizations)\n- [Manage Advanced API Security for Subscription organizations](/apigee/docs/api-security/enable-security#manage-advanced-api-security-for-subscription-organizations)\n\nYou can try Advanced API Security for free in any trial organization. Contact [Apigee Sales](https://pages.apigee.com/contact-sales-reg.html) to learn more.\n\nAdvanced API Security features\n------------------------------\n\nThe following sections briefly describe the features of Advanced API Security.\n\n### Abuse detection\n\n[Abuse\ndetection](/apigee/docs/api-security/abuse-detection) shows you security incidents involving your APIs. A security incident is a group\nof detected security events that are related to each other. Advanced API Security uses\n[detection rules](/apigee/docs/api-security/detection-rules), based on\nGoogle's machine-learning algorithms, to identify patterns that are signs of malicious activity,\nincluding API scraping and anomalies. You can then take measures to counter those threats\nusing [security actions](#security-actions).\n\n### Security reports\n\n[Security reports](/apigee/docs/api-security/security-report-jobs) give you more in-depth analysis of security threats to your APIs.\nFor example, you can create reports for the number of malicious requests\nby various dimensions, such as the country of origin of the request. You can view these\nreports in the Apigee UI or via the API.\n\n### Risk assessment\n\n[Risk assessment](/apigee/docs/api-security/security-scores) helps you identify APIs\nthat don't conform to security standards. Risk assessment regularly evaluates your API configurations\nand calculates scores to rate their security level. When a low score indicates a configuration\nissue, Advanced API Security provides recommendations to resolve the problem.\n\n### Security actions\n\n[Security actions](/apigee/docs/api-security/security-actions) let you\ndefine how Apigee handles detected traffic, based on information from the Abuse detection page.\nFor example, you can create a security action to deny requests from an IP address that has been\nidentified as a source of abuse.\n\n### Security alerts\n\nYou can configure [security alerts](/apigee/docs/api-security/security-alerts)\nto send you notifications when Advanced API Security detects\nevents related to Advanced API Security, such as changes to your security scores or security incidents.\n\nData obfuscation with Advanced API Security\n-------------------------------------------\n\nAdvanced API Security works with data that is obfuscated to replace sensitive data with a hashed value. See\n[Obfuscate user data for Apigee API Analytics](/apigee/docs/api-platform/analytics/obfuscate-user-data-for-analytics)\nfor information on the data obfuscation functionality.\n\n\nWhen obfuscation is configured, Advanced API Security checks such as in [Abuse detection](#abuse-detection)\nand [Security actions](#security-actions) are applied before the obfuscation. For example,\nit's possible to detect abuse from a specific IP address even if the IP address is obfuscated. However,\nobfuscated values (such as client IP address) are not viewable to users in clear (unhashed) text within the\nAdvanced API Security UIs or APIs. The hashed values are shown.\n\n\nIn some cases you need to obtain an unobfuscated data value to use with Advanced API Security. For example,\nyou might need a client IP address to configure a Security action. If the value is already obfuscated, you\ncan't retrieve the clear text IP address. Using the obfuscated (hashed) value in the Security action\nconfiguration doesn't work since data obfuscation uses a one-way hash and Advanced API Security cannot\nconvert the hashed value back to the clear text value."]]
