Detecting low-and-slow attack activity that targets an API’s unique vulnerabilities depends on having context. Building that context requires deep analysis of massive amounts of API traffic. This kind of advanced protection must have a rich baseline of normal behavior for every API and user so that the system can spot anomalies quickly and correlate activity over time to build a fingerprint for each bad actor.