This page defines the key concepts you'll encounter when using Anti-DDoS Native.
DDoS attack
A Distributed Denial of Service (DDoS) attack attempts to make a service unavailable by overwhelming it with traffic. DDoS attacks fall into two categories:
Volumetric attacks: Target network bandwidth. Attackers use multiple compromised machines or attack simulators to flood a target with requests or data packets, exhausting bandwidth until the service becomes unavailable.
Application-layer attacks: Target servers directly. Malicious requests exhaust server memory or CPU, preventing the server from responding to legitimate requests.
Traffic scrubbing
Traffic scrubbing uses an anti-DDoS device or service to inspect and filter inbound traffic. It separates attack traffic from service traffic, forwarding only service traffic to the server. This reduces pressure on the server and keeps the service available during an attack.
When attack traffic exceeds the mitigation capability, traffic scrubbing alone can no longer protect the service. At that point, blackhole filtering is triggered.
Blackhole filtering
Blackhole filtering is triggered when a DDoS attack exceeds the mitigation capability provided for a service. To protect other services on the same network, the system discards all inbound traffic destined for the affected service.
Best-effort protection
Best-effort protection defends against DDoS attacks based on the network capacity of the cloud data center where your assets are hosted. The protection level is dynamic: it improves as Alibaba Cloud expands its network infrastructure, but may be reduced during periods of high data center demand.
For the protection capabilities of each Anti-DDoS Native instance type, see Mitigation capabilities.
Mitigation sessions
A mitigation session tracks how much best-effort protection a protected asset has consumed in a given month.
How sessions are counted:
The system records a traffic data point every 5 seconds (12 per minute). When attack traffic exceeds the threshold N Gbit/s, the system starts accumulating attack duration. Every 15 minutes of accumulated attack time (180 data points) consumes one mitigation session. For information on how to check your remaining sessions, see Manage instances.
Asset location | Threshold (N) |
The Chinese mainland | 20 Gbit/s |
Outside the Chinese mainland | 10 Gbit/s |
The red line represents the inbound traffic of a public IP-enabled asset. The accumulated attack duration (X+Y in the diagram) counts toward session consumption.
Example: An asset located in the Chinese mainland is under attack. The instance has 2 protection sessions.
First attack: Duration exceeding 20 Gbit/s is 10 minutes.
Second attack: Duration exceeding 20 Gbit/s is 12 minutes.
Total cumulative duration: 22 minutes.
Session consumption process:
First session consumption:
During the second attack, when the cumulative attack duration reaches 15 minutes (10 minutes from the first attack + 5 minutes from the second), the first protection session is consumed. The remaining 7 minutes of the second attack (22 - 15 = 7) are carried forward to the next counting cycle.Second session consumption:
If attacks continue within the same month, the carried-forward 7 minutes will accumulate with any new attack duration. When the cumulative duration in this new cycle reaches 15 minutes, the second protection session is consumed.