Billing of elastic protection capability - Anti-DDoS - Alibaba Cloud Documentation Center

What is elastic protection capability?

Elastic protection capability is the maximum capacity of an Anti-DDoS Proxy instance to mitigate DDoS attacks. The elastic protection capability must be greater than the basic protection bandwidth. If you set the elastic protection capability to the same value as the basic protection bandwidth, the instance does not use burstable protection and no pay-as-you-go bills are generated.

Differences between basic protection bandwidth and elastic protection capability

Basic protection bandwidth and elastic protection capability are two mitigation capabilities of an Anti-DDoS Proxy instance. They differ fundamentally in billing method, activation conditions, and role:

Item	Basic protection bandwidth	Elastic protection capability
Billing method	Subscription (prepaid), selected when you purchase the instance	Pay-as-you-go (billed daily), charged only when burstable protection is triggered
Activation conditions	Always in effect for the instance, providing Anti-DDoS Basic mitigation capacity (blackhole threshold)	Triggered only when attack traffic exceeds the basic protection bandwidth but does not exceed the elastic protection capability
Role	The concurrent peak mitigation capacity of the instance, which continuously defends against routine attacks	The extended mitigation ceiling for burst attacks, which provides short-term capacity to withstand traffic spikes
Behavior when exceeded	After attack traffic exceeds the basic protection bandwidth, the elastic protection capability continues to mitigate the attack, provided that burstable protection is enabled	When attack traffic exceeds the upper limit of the elastic protection capability, the IP address of the attacked asset enters blackhole filtering status and no elastic protection fees are incurred

Important

Basic protection bandwidth is the Anti-DDoS Basic mitigation capacity that remains in effect for the instance. It is not a quota that is consumed after a single use. Elastic protection capability is an extended ceiling for burst attacks rather than unlimited automatic scaling. The actual mitigation capacity is limited by the elastic protection capability specification that you configure. Anti-DDoS Proxy (burstable protection) and Anti-DDoS Native (Anti-DDoS plan) are different protection products, and their billing and deduction rules are independent of each other.

Instance types that support elastic protection capability

Anti-DDoS Proxy (Chinese Mainland): Professional edition

Conditions for incurring fees

Elastic protection fees are incurred only when the peak inbound traffic to assets that are assigned public IP addresses is greater than the basic protection bandwidth and less than the elastic protection capability.

Note

If the peak inbound traffic is less than the basic protection bandwidth, or greater than the elastic protection capability, burstable protection is not triggered and no elastic protection fees are incurred.
If the peak inbound traffic is greater than the elastic protection capability, the instance cannot mitigate the DDoS attack and the IP address of the attacked asset enters blackhole filtering status. For more information, see Alibaba Cloud blackhole filtering policy.

How fees are calculated

First, subtract the basic protection bandwidth from the peak inbound traffic that triggered burstable protection on that day. Then, find the billing tier that the result falls into in the following table to determine the elastic protection fees for that day.

Note

If burstable protection is triggered multiple times within a calendar day, the elastic protection fees for that day are calculated based on the highest peak inbound traffic among those events, regardless of the number of attacks.

Billing tier	Elastic protection fee (unit: USD/day)
(0 Gbps,5 Gbps]	120
(5 Gbps,10 Gbps]	180
(10 Gbps,20 Gbps]	330
(20 Gbps,30 Gbps]	540
(30 Gbps,40 Gbps]	730
(40 Gbps,50 Gbps]	960
(50 Gbps,60 Gbps]	1,170
(60 Gbps,70 Gbps]	1,380
(70 Gbps,80 Gbps]	1,590
(80 Gbps,100 Gbps]	1,770
(100 Gbps,150 Gbps]	2,190
(150 Gbps,200 Gbps]	3,240
(200 Gbps,300 Gbps]	4,200
(300 Gbps,400 Gbps]	6,000
(400 Gbps,500 Gbps]	7,510
(500 Gbps,600 Gbps]	9,010
(600 Gbps,700 Gbps]	10,510
(700 Gbps,800 Gbps]	12,010
(800 Gbps,900 Gbps]	13,510
(900 Gbps,1000 Gbps]	15,010
(1000 Gbps,1100 Gbps]	16,510
(1100 Gbps,1200 Gbps]	18,010
(1200 Gbps,1300 Gbps]	19,510
(1300 Gbps,1400 Gbps]	21,010
(1400 Gbps,2000 Gbps]	22,520

Billing cycle

Pay-as-you-go, billed by day. The bill is generated between 08:00 and 09:00 (UTC+8) the following day.

Billing example

An Anti-DDoS Proxy instance has a basic protection bandwidth of 30 Gbps and an elastic protection capability of 100 Gbps. On a given day, the instance suffers four DDoS attacks, and the peak inbound traffic of each attack is 20 Gbps, 80 Gbps, 40 Gbps, and 120 Gbps.

Cost analysis:

The peak inbound traffic is 20 Gbps, which is less than the basic protection bandwidth of 30 Gbps. Burstable protection is not triggered, so no elastic protection fees are incurred.
The peak inbound traffic is 80 Gbps, which is greater than the basic protection bandwidth of 30 Gbps and less than the elastic protection capability of 100 Gbps. Burstable protection is triggered, so elastic protection fees are incurred.
The peak inbound traffic is 40 Gbps, which is greater than the basic protection bandwidth of 30 Gbps and less than the elastic protection capability of 100 Gbps. Burstable protection is triggered, so elastic protection fees are incurred.
The peak inbound traffic is 120 Gbps, which is greater than the elastic protection capability of 100 Gbps. The instance cannot mitigate the DDoS attack and the IP address of the attacked asset enters blackhole filtering status. Burstable protection is not triggered, so no elastic protection fees are incurred.

Cost calculation: The highest peak inbound traffic that actually triggered burstable protection on that day is 80 Gbps. Subtracting the basic protection bandwidth of 30 Gbps gives 50 Gbps, which falls into the (40 Gbps,50 Gbps] billing tier. Therefore, the elastic protection fees incurred on that day are USD 960.

Enable elastic protection capability

Enable during purchase

Go to the Anti-DDoS Proxy (Chinese Mainland) buy page. When you purchase an instance, configure the elastic protection capability. Make sure that the elastic protection capability is greater than the basic protection bandwidth.

The basic protection bandwidth is billed upfront on a subscription basis, and the elastic protection capability is the maximum protection bandwidth. If the elastic protection capability is the same as the basic protection bandwidth, no pay-as-you-go fees are generated. If the elastic protection capability is greater than the basic protection bandwidth, the excess is billed on a pay-as-you-go basis by day.

Enable after purchase

Log on to the Instances page in the Anti-DDoS Proxy console.
On the Instances page, in the Protection Bandwidth: section, modify the elastic protection capability. Make sure that the elastic protection capability is greater than the basic protection bandwidth.

FAQ

How do I choose an Anti-DDoS Proxy plan and evaluate burstable protection requirements based on current attack traffic?

Select a DDoS protection plan and evaluate attack traffic based on the following strategies:

Select a basic protection bandwidth specification: Purchase a basic protection bandwidth specification that matches the attack traffic your business faces daily. Basic protection bandwidth provides Anti-DDoS Basic mitigation capacity that is always in effect and is suitable for defending against routine attacks.
Enable elastic protection capability to handle traffic bursts: If your business may suffer sudden volumetric attacks that exceed the basic protection bandwidth, enable elastic protection capability. Elastic protection capability provides short-term capacity to withstand traffic spikes and incurs pay-as-you-go fees by day only when it is actually triggered. Evaluate the burstable protection specification that you select based on your business budget.
Upgrade the specification when the limit is continuously exceeded: If attack traffic continuously exceeds the upper limit of the current elastic protection capability, the IP addresses of your assets frequently enter blackhole filtering status. To improve the mitigation capacity, upgrade the basic protection bandwidth specification or increase the elastic protection capability specification.

What do I do if high traffic persists after I adjust the bandwidth and restrict suspicious IP addresses?

If you have adjusted the bandwidth configuration and restricted suspicious IP addresses but abnormally high traffic persists, troubleshoot the issue by performing the following steps:

Verify the traffic type: First, confirm whether the current high traffic is normal service traffic rather than DDoS attack traffic. You can use the network traffic analysis feature in the Anti-DDoS Proxy console to view the traffic source and characteristics and distinguish normal service access from attack traffic.
Handle normal service traffic growth: If the insufficient bandwidth is confirmed to be caused by the growth of normal service traffic, upgrade the basic protection bandwidth or the elastic protection capability specification to make sure that the mitigation capacity covers the normal peak traffic of your business.
Mitigate application-layer attacks: If you suspect that the unusual traffic is caused by application-layer (Layer 7) attacks such as HTTP flood attacks, note that Anti-DDoS Proxy mainly mitigates network-layer (Layer 3 and Layer 4) attacks. Its capability to block application-layer attacks is limited. Use the pay-as-you-go edition of Web Application Firewall (WAF) for testing and mitigation. WAF can identify and block malicious requests at the application layer.

Anti-DDoS:Billing of elastic protection capability