Anti-DDoS:Anti-DDoS Autopilot

Feature overview

Autopilot proactively constructs business profiles, continuously learns traffic patterns, and dynamically evaluates the effectiveness of protection policies. In environments with highly volatile traffic or intense attack-defense dynamics, it autonomously adjusts the protection posture to improve mitigation accuracy and reduce false positives. This minimizes the operational overhead of managing built-in static rules and user-defined policies.

Core values

• Automated business profiling: By analyzing network traffic patterns, such as protocols, connection states, and traffic direction, the feature proactively builds business profiles to deliver precise and highly tailored protection.

• Continuous adaptation: It dynamically adjusts protection policies based on evolving traffic and attack signatures, ensuring an optimal balance between mitigation efficacy and service availability.

• Transparent operations: The console provides full visibility into inspection states, policy modifications, and the outcomes of posture adjustments.

How it works

Autopilot is a fully managed protection mode that operates independently of the traditional built-in policy templates (Normal, Loose, or Strict). It layers proactive, adaptive defenses on top of baseline protection rules. While it abstracts the complexities of the attack-defense cycle, you can monitor routine business profile updates and posture adjustment results directly in the console.

The dynamic rules generated by Autopilot are managed by the system. They are invisible to users, cannot be edited, and are not appended to your custom policies. Your existing custom policies continue to be managed independently and run concurrently with Autopilot without interference.

Typical scenarios

Autopilot is suitable for most workloads, particularly those with highly fluctuating traffic, frequent promotional events, complex protocols, or limited dedicated security operations resources. Even for stable workloads, Autopilot continuously tracks traffic variations and attack trends to keep protection policies aligned with your current business state. If you prefer to use static policy templates, you can continue to use the traditional Normal, Loose, or Strict modes.

• High-traffic online workloads and large language model (LLM) inference services: Workloads characterized by high-frequency requests, large payloads, long-lived connections, or concentrated egress IP addresses often exhibit high packet rates. During traffic scrubbing, static policies might misidentify this legitimate traffic as malicious, resulting in timeouts, 5xx HTTP errors, or dropped connections. Autopilot leverages traffic profiling to recognize these traits and continuously calibrates the protection posture to minimize false positives.

• Outbound workloads using SNAT or NAT gateways: Workloads that initiate outbound connections have different traffic flow patterns compared to standard inbound services. Response packets might be rate-limited or dropped by generic policies, leading to impaired outbound access or intermittent disconnections. Autopilot identifies outbound connection patterns and applies the appropriate protection posture to prevent service interruptions during mitigation.

Configuration methods

The following steps apply to Anti-DDoS Native. For Anti-DDoS Proxy (Chinese Mainland) and Anti-DDoS Proxy (Outside Chinese Mainland), see Enable Anti-DDoS Autopilot.

1. Log on to the Traffic Security console. In the left-side navigation pane, choose DDoS.

2. In the upper-left corner of the top navigation bar, select the resource group and region of your instance.

3. On the Protected Objects page, select the protection instance and the IP asset that you want to protect.

4. Under Mitigation Policy, select Autopilot.

5. Review the system-generated business profile. You can optionally add tags or natural language descriptions to specify upcoming events, launches, or protocol modifications.

6. After the feature is enabled, monitor the inspection status and policy adjustment results on the Autopilot details page.

To disable Autopilot, follow the console prompts to switch to the built-in Normal, Loose, or Strict protection template.

Modes and states

If the asset remains in the Autopilot Expired state, the system automatically resumes Autopilot in the next evaluation cycle after you recharge your credits. However, if you manually switch to the Normal, Loose, or Strict mode, Autopilot does not automatically resume after a recharge. You must manually re-enable it.

Credits billing

Accounts with an Anti-DDoS Native instance receive 70,000 free credits each month, shared across the account. The free quota resets on the first day of each month and does not roll over or accumulate. As a default benefit for accounts that owned an Anti-DDoS Native instance before September 15, 2026, the system automatically selects up to seven assets that are currently using built-in protection in Normal mode and upgrades them to Autopilot mode. You can manually disable this feature as needed.

Credits support two purchase options: Credit Plan and Credit Pack. These options are sold independently and can be used together.

• A Credit Plan refreshes the purchased credit quota monthly after you subscribe. Each user can have only one Credit Plan instance at a time. If your credits run out, you can either upgrade your Credit Plan or purchase Credit Packs for additional credits. After purchase, a Credit Plan cannot be unsubscribed, refunded, or downgraded.

• Credit Packs do not renew automatically. You can purchase multiple Credit Packs and use them together. A Credit Pack takes effect immediately after purchase and is deducted based on usage during its validity period. Unused credits expire automatically when the validity period ends and do not roll over. Credit Packs cannot be refunded after purchase.

Only protected objects in Autopilot mode consume credits: Anti-DDoS Native counts by IP address, and Anti-DDoS Proxy counts by domain name and instance. Credits are deducted in the following order: free credits > Credit Plan credits > Credit Pack credits. If multiple Credit Packs are available, the system deducts credits from the pack that expires first.

To view your balance or purchase a Credit Plan or Credit Pack, go to Credits Usage Details in the console.