A firewall function that analyzes the normal activities of your computer’s applications and processes. The firewall uses this training period as a baseline, so that later, it can more easily determine what activities deviate from normal. (If you do not enable a training period, numerous alerts may display for all Internet applications and WinAPI processes as they launch, which may require you to take action by selecting “allow” or “block” each time one of these events first occurs.)