Global advanced mitigation sessions are add-on packages that extend the number of advanced mitigation events available each calendar month. This page explains how sessions are counted, what each package covers, and the associated costs.
How a session is counted
An advanced mitigation session is consumed when a DDoS attack on a single IP address of an Anti-DDoS Proxy instance exceeds 5 Gbps. Once triggered, the session covers all attacks on that IP address for the next 24 hours — regardless of how many attacks occur within that window, only one session is used.
A volumetric attack is any attack where traffic exceeds the basic protection bandwidth of the instance.
Default sessions included with each instance
Each instance type includes a fixed number of advanced mitigation sessions per calendar month.
| Product | Instance type | Default sessions/month |
|---|---|---|
| Anti-DDoS Pro (Chinese Mainland) | Premium Edition | 2 |
| Anti-DDoS Premium (Outside Chinese Mainland) | Insurance mitigation plan | 2 |
| Anti-DDoS Premium (Outside Chinese Mainland) | Sec-MCA 1.0 | 2 |
| Anti-DDoS Premium (Outside Chinese Mainland) | Sec-MCA 1.0 (Basic Edition) | 1 |
| Anti-DDoS Premium (Outside Chinese Mainland) | Sec-CMA 2.0 | 0, 1, 2, or unlimited (configurable) |
When the default sessions for an instance are exhausted in a calendar month, Anti-DDoS Pro and Anti-DDoS Premium automatically draw from your purchased global advanced mitigation sessions — if any are available — to continue protecting your services.
Global advanced mitigation session packages
Three session package types are available, one for each supported instance category. Sessions in a package apply to all unexpired instances of the matching type under your Alibaba Cloud account; you do not assign them to a specific instance.
Sec-CMA 2.0, Sec-CMA 2.0 (Insurance), and Sec-CMA 2.0 (Unlimited) do not support purchasing global advanced mitigation sessions.
| Premium Edition global session | Insurance global session | Sec-MCA global session | |
|---|---|---|---|
| Applies to | All unexpired Premium Edition instances | All unexpired Insurance mitigation plan instances | All unexpired Sec-MCA 1.0 and Sec-MCA 1.0 (Basic Edition) instances |
| Validity | 1 year from purchase, or 1 month from purchase | 1 year from purchase | 1 year from purchase |
| Monthly limit | None | 20 sessions/month per account (includes default + purchased sessions); feature frozen if exceeded | 20 sessions/month per account (same rule) |
| Price | USD 4,045 (1-year) or USD 2,050 (1-month) | USD 1,580/time | USD 7,790/operation |
Monthly cap for Insurance and Sec-MCA sessions
Each Alibaba Cloud account can use a maximum of 20 advanced mitigation sessions per calendar month across Insurance mitigation plan, Sec-MCA 1.0, and Sec-MCA 1.0 (Basic Edition) instances combined. This cap includes both the default sessions bundled with instances and any sessions drawn from purchased packages.
If the cap is reached, the advanced mitigation feature is frozen for the rest of that calendar month and resumes automatically at the start of the next month.
If your services face frequent volumetric attacks, consider an Anti-DDoS Premium (Outside Chinese Mainland) Unlimited instance, which provides unlimited advanced mitigation sessions without a monthly cap.
Purchase a global advanced mitigation session
For instructions, see Purchase a global advanced mitigation session.
Billing model
Global advanced mitigation sessions are sold on a subscription basis and require full payment at the time of purchase.
Overdue payments: Not applicable. The subscription model means no post-consumption charges are incurred.
Refunds: Sessions are non-refundable after purchase.
View your bills
Query bills in the Expenses and Costs console. For more information, see Overview of monthly bills.