Anti-DDoS Native is a security service that directly strengthens the DDoS mitigation capability of Alibaba Cloud services. It protects cloud services without changes to your network architecture. After you purchase an instance and associate IP addresses with it, protection takes effect within minutes. Anti-DDoS Native primarily mitigates Layer 3 and Layer 4 volumetric DDoS attacks and is suitable if you want to strengthen your baseline DDoS defenses quickly at a low cost.
Concepts
DDoS attack: A distributed denial-of-service (DDoS) attack consumes network or device resources with malicious traffic and makes a service unavailable. For more information, see What is a DDoS attack?.
How it works
Anti-DDoS Native uses bypass deployment mode, with DDoS attack detection and traffic scrubbing systems deployed at the egress of Alibaba Cloud data centers. It primarily uses threshold-based scrubbing, supplemented by active blocking, to identify and scrub DDoS attack traffic without affecting legitimate workloads.
Attack detection: The system monitors traffic flowing through public IP addresses in real time.
Traffic scrubbing: When inbound traffic exceeds the scrubbing threshold, the system automatically redirects the traffic to a scrubbing center.
Traffic reinjection: After the scrubbing center discards attack traffic, it reinjects clean service traffic to the origin server, keeping your services accessible while the attack continues.
Benefits
Instant deployment: Protection takes effect after purchase, and deployment can complete in as little as one minute. Mitigation capability is applied directly to cloud services, with no need to deploy or replace IP addresses.
Elastic defense: During large-scale attacks, the system automatically uses all DDoS mitigation resources in the current region to provide unlimited protection.
Multi-carrier BGP access: Border Gateway Protocol (BGP) bandwidth allows a single IP address to deliver high-speed access across carrier networks such as China Telecom, China Unicom, and China Mobile.
Large-scale scrubbing capacity: Sufficient scrubbing bandwidth meets the security needs of major promotional events, new product launches, and critical workloads.
Flexible sharing: Multiple IP addresses can share the same protection instance to meet the mitigation needs of multiple assets.
Supported cloud service types
Comparison dimension | Standard cloud services | Enhanced cloud services |
Definition | Cloud services that have the default Alibaba Cloud DDoS mitigation capability, such as standard ECS instances, EIPs, and SLB instances. | Cloud services for which enhanced DDoS protection is enabled at purchase. Currently, this refers only to Anti-DDoS Native (Advanced) EIP(Anti-DDoS Advanced EIP). |
How mitigation policies take effect | Mitigation policies, such as blacklists and whitelists or the Location Blacklist policy, take effect only when the asset is under attack and its traffic is being scrubbed. | Mitigation policies are always in effect. All traffic is processed by the scrubbing center. |
Mitigation capability | Shares region-level scrubbing capacity, which can reach hundreds of Gbps in the Chinese mainland. | Provides Tbps-level unlimited protection. |
Purchase configuration | When you purchase an EIP, set Security Protection to Default. | When you purchase an EIP, set Security Protection to Anti-DDoS (Pro/Premium). |
Anti-DDoS Native editions
Category | Instance edition | Description |
Anti-DDoS Native 1.0 (subscription) | Enterprise | No longer available for new purchases. |
Anti-DDoS Native 2.0 (subscription) | SMB, Enterprise | Supports standard cloud services and Anti-DDoS Advanced EIP (EIP with enhanced DDoS protection) assets. SMB supports only standard cloud services and does not support Anti-DDoS Advanced EIP.
|
Anti-DDoS Native 2.0 (pay-as-you-go) | Enterprise | No longer available for new purchases. Supports standard cloud services and enhanced cloud services. |
Instance specification comparison
Comparison item | Anti-DDoS Native 1.0 | Anti-DDoS Native 2.0 subscription | Anti-DDoS Native 2.0 pay-as-you-go (No longer available for new purchases) | |
Enterprise | SMB | Enterprise | Enterprise | |
Protected objects | Alibaba Cloud services: ECS, SLB, EIPs (including EIPs associated with NAT gateways), IPv6 gateways, Simple Application Server, WAF, and GA |
| ||
Billing method | Subscription | Subscription | Subscription | Pay-as-you-go |
Mitigation sessions | Unlimited | 2 per month | Unlimited | Unlimited |
Protected asset types | Standard cloud services | Standard cloud services and enhanced cloud services (Anti-DDoS Advanced EIP) | ||
Number of regions of protected assets | Protects assets that are assigned public IP addresses in one region. | Protects assets that are assigned public IP addresses in one region. | Protects assets that are assigned public IP addresses in all regions under the current Alibaba Cloud account. | Protects assets that are assigned public IP addresses in all regions under the current Alibaba Cloud account. |
Network type of protected assets | Protects assets that are assigned only one type of public IP address: IPv4 or IPv6. | Protects assets that are assigned only one type of public IP address: IPv4 or IPv6. | Protects both IPv4 and IPv6 assets that are assigned public IP addresses. | Protects both IPv4 and IPv6 assets that are assigned public IP addresses. |
Number of protected IP addresses | Starts at 100 when you purchase an instance, and you can select the quota freely. | You can select 1 to 29 when you purchase an instance. | You can select 30 to 2,000 when you purchase an instance. For a higher specification, contact your business manager. | Up to 2,000. |
Clean bandwidth | You can select the bandwidth freely when you purchase an instance and expand it without an upper limit. | You can select 50 Mbps to 1,000 Mbps when you purchase an instance. | Starts at 100 Mbps when you purchase an instance. You can select the bandwidth freely and expand it without an upper limit. Standard cloud services have no bandwidth limit. Enhanced cloud services (Anti-DDoS Advanced EIP) have a bandwidth limit. |
|
Burstable clean bandwidth | Not supported. | Supported. The daily 95th percentile metering method is enabled by default. After it is enabled, the total supported clean bandwidth is five times the guaranteed clean bandwidth. | Not applicable. | |
SLS logs | Supported. | Not supported. | Supported. | Supported. |
Multi-account management | Not supported. | Not supported. | Supported. | Supported. |
Protection performance comparison
Anti-DDoS Native is available in versions 1.0 and 2.0. Version 1.0 is no longer available for new purchases. The following table lists reference mitigation capability values for version 2.0 only.
Anti-DDoS Native uses the "unlimited protection" model. Its mitigation capability is not a fixed value but adjusts dynamically based on the overall mitigation capacity of the cloud data center. The mitigation capacity usually increases as Alibaba Cloud expands its network infrastructure, but it may also decrease temporarily in special cases such as resource constraints.
Region | Anti-DDoS Native 2.0 (subscription) SMB | Anti-DDoS Native 2.0 (subscription) Enterprise | Anti-DDoS Native 2.0 (pay-as-you-go) Enterprise (No longer available for new purchases) | |||
Standard cloud services | Standard cloud services | Enhanced cloud services | Standard cloud services | Enhanced cloud services | ||
The Chinese mainland | China (Beijing), China (Shanghai), China (Hangzhou), China (Shenzhen), China (Ulanqab), China (Zhangjiakou), China (Hohhot), China (Heyuan) | Up to 300 Gbps to 600 Gbps. | Up to the Tbps level. Available for purchase only in China (Beijing), China (Shanghai), and China (Hangzhou). | Up to 300 Gbps to 600 Gbps. | Up to the Tbps level. Available for purchase only in China (Beijing), China (Shanghai), and China (Hangzhou). | |
China (Chengdu), China (Guangzhou), and China (Qingdao) | Up to tens of Gbps. | Up to tens of Gbps. | ||||
Outside the Chinese mainland | China (Hong Kong), Singapore, Germany (Frankfurt), US (Silicon Valley), US (Virginia), and France (Paris) | Up to 100 Gbps to 200 Gbps. | Up to the Tbps level. | Up to 100 Gbps to 200 Gbps. | Up to the Tbps level. | |
Japan (Tokyo) | Up to tens of Gbps. | Up to the Tbps level. | Up to tens of Gbps. | Up to the Tbps level. | ||
Other regions | Limited mitigation capability (less than 10 Gbps). | Up to the Tbps level. | Limited mitigation capability (less than 10 Gbps). | Up to the Tbps level. | ||
Get started with Anti-DDoS Native
Purchase an Anti-DDoS Native instance. To add Anti-DDoS Advanced EIP assets, first complete service-linked role (SLR) authorization. For more information, see Protection authorization (first purchase).
Add assets that are assigned public IP addresses to the instance as protected objects. For more information, see Protected objects.
Configure custom mitigation policies based on the characteristics of your service traffic. For more information, see https://www.alibabacloud.com/help/zh/anti-ddos/anti-ddos-origin/user-guide/protection-configuration/.
View monitoring data for service traffic. For more information, see Business Monitoring.
Enable Mitigation Logs. Use mitigation analysis to query and analyze mitigation logs and view built-in mitigation reports. For more information, see Enable mitigation analysis.
After assets that are assigned public IP addresses are attacked, view attack event details. For more information, see Attack analysis.
View blackhole and scrubbing events. For more information, see Event center.
FAQ
What is the difference between Anti-DDoS Native and Anti-DDoS Proxy?
Comparison dimension
Anti-DDoS Native
Anti-DDoS Proxy
Core positioning
Enhanced protection for cloud services.
Independent, professional-grade protection.
Access method
Associates with existing public IP addresses. No IP address replacement is required.
Routes service traffic to the IP address of an Anti-DDoS Proxy instance.
Mitigation capability
Shared at the region level, with an upper limit (Gbps level).
Independent resources, up to the Tbps level, with a higher SLA.
Applicable scenarios
Strengthen baseline defenses conveniently and at a low cost.
Critical workloads that must withstand very large-scale attacks.
Cost
Relatively low.
Relatively high.
Can Anti-DDoS Native defend against CC attacks (application-layer attacks)?
No. Anti-DDoS Native primarily mitigates Layer 3 and Layer 4 volumetric attacks, such as UDP Flood and SYN Flood.