HTTP DoS Profiles & Learning process

Hello Dear F5 Community !

I'm trying to understand better all the secrets of the HTTP DoS Profiles I created and attached to some VIPs in transparent mode.

I essentially wanna see the evolution of the learning process via the following command :

admd -s vs. | grep info.learning

Here is an example of the output I get :

vs./Common/VS_TEST_1+/Common/DoS-L7_TEST_1.info.learning:[73.685, 693, 1108896, 100]
vs./Common/VS_TEST_2+/Common/DoS-L7_TEST_2.info.learning:[79.6533, 690, 6208526, 100]
vs./Common/VS_TEST_3+/Common/DoS-L7_TEST_3.info.learning:[65.2094, 299, 33624, 100]
vs./Common/VS_TEST_4+/Common/DoS-L7_TEST_4.info.learning:[58.057, 250, 483729, 100]
vs./Common/VS_TEST_5+/Common/DoS-L7_TEST_5.info.learning:[52.8262, 678, 33330, 100]
vs./Common/VS_TEST_6+/Common/DoS-L7_TEST_6.info.learning:[74.8512, 685, 288011, 100]

Although the VIPs & Profiles names have been anonymized here, these are production VIPs with a lot of traffic.

According to F5 docs & labs, the 1st number into the brackets represents the "baseline_learning_confidence" which is in % how confident the system is in the baseline learning.

Still according to F5 docs & labs, this number should reach around 90-95% before we should feel safe about activating the blocking mode instead of transparent mode.

It's been a whole week now and these "baseline_learning_confidence" numbers still oscillate between 40% and 80% (for each VS+Profile) every time I check via the "admd -s" command.

So I wonder why, and if it's safe anyway to activate the blocking mode on these HTTP DoS Profile.

Anyone had some similar experience with HTTP DoS profiles ?

Some precisions :

- an example of F5 lab about this topic : https://clouddocs.f5.com/training/community/ddos/html/class7/bados/module1.html
- these are DoS profiles created from the "Security/DoS Protection/Protection Profiles" menu in v17.1.x
- only the "HTTP" has been activated in these profiles "families" setting
- no TPS-based settings activated, only stress-based & behavioral/bad actors settings, with "Threshold Mode" set to "Automatic"
- some of the VIPs have a default pool + another pool invoked via iRule/LTP (maybe it's more difficult to establish a baseline for such traffic) but some other are more standard with only a default pool.

Many thanks !

David