Anti-DDoS Proxy enables intelligent protection by default for website services that are added to it. Intelligent protection automatically learns your service traffic baseline to detect and block new types of CC attacks. This topic describes how to use intelligent protection.
What is intelligent protection?
Intelligent protection builds on the traditional mitigation methods of Anti-DDoS Proxy to address diverse service types and frequently changing attack scenarios. Based on the big data capabilities of Alibaba Cloud, intelligent protection automatically learns the traffic baseline of your website services and analyzes attack anomalies by using algorithms. It then automatically applies accurate access control rules to dynamically adjust the service protection model. This helps you promptly detect and block malicious web attacks, such as malicious bots and HTTP flood attacks.
Supported modes and levels
Intelligent protection supports the following modes and levels. After a website service is added to Anti-DDoS Proxy, the intelligent protection policy is enabled by default with the mode set to Protection and the level set to Normal.
Mode
Warning: When malicious requests are detected, only attack warning logs are recorded and no access requests are blocked. This helps you understand the effectiveness of intelligent protection. In Warning mode, you can use Log Analysis to query the attack warning records that are related to intelligent protection and verify its attack prevention capability. For more information, see View attack warning logs.
Protection: When malicious requests are detected, accurate access control rules are applied directly to block the requests.
NoteIn most cases, use Warning mode first and observe the attack log records in Log Analysis reports. After you fully confirm the effectiveness of intelligent protection, enable Protection mode so that intelligent protection takes effect.
Level
Protection level
Protection effect
Use cases
Loose
Blocks only specific known malicious attacks and does not mistakenly block normal requests.
Suitable for large websites with strong processing performance, and for specific situations such as major promotions.
Normal (Recommended)
In most cases, no action is taken on requests. When traffic is detected to threaten the website, intelligent protection defends against malicious attacks with minimal impact on normal website services.
Suitable when the request volume is stable and the server has spare processing capacity after it handles normal traffic.
Strict
Applies strict intelligent defense against malicious attacks. Some requests may be mistakenly blocked.
Suitable when website performance is poor or the protection effect is unsatisfactory.
Prerequisites
A website service is added to Anti-DDoS Proxy. For more information, see Add websites.
Adjust the mode or level of intelligent protection
If your service runs under special circumstances, adjust the intelligent protection policy so that the AI policy learns sufficiently and requests are not mistakenly blocked.
Scenario: Before the website is added to Anti-DDoS Proxy, a regular rate limiting policy is configured on the origin server, or many clients frequently reconnect at the same time. As a result, the service returns many 4XX or 5XX status codes under normal conditions.
Recommended actions:
On the Protection for Website Services tab, in the Intelligent Protection module, click Settings.
In the Intelligent Protection dialog box, set Mode to Warning.
Wait three days, and then change Mode to Protection.
If your website is about to run a major promotion or a stress test and the origin server returns many 4XX or 5XX status codes, use a scenario-specific policy. For more information, see Scenario-specific policies.
View intelligent protection rules
After intelligent protection is enabled, Anti-DDoS Proxy automatically generates accurate access control rules when it detects malicious attacks. All rule names start with smartcc_, and the rules have a validity period. Unlike custom accurate access control rules, intelligent protection rules have the following characteristics:
The rule action may be warning: In Warning mode, the accurate protection rules that intelligent protection automatically generates use the warning action. These rules only record attack logs and do not block requests.
The rules are time-limited: Rules applied by intelligent protection have a validity period. After the period expires, the rules automatically become invalid and are deleted.
Manual deletion is not supported: You cannot delete these rules. However, if you disable intelligent protection, all intelligent protection rules are immediately cleared.
Log on to the Anti-DDoS Proxy console.
In the top navigation bar, select the region of your instance.
Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.
Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.
In the left-side navigation pane, choose .
On the General Policies page, click the Protection for Website Services tab, and then select the target domain name from the domain name list on the left.
In the HTTP Flood Mitigation section, click Settings and view the rules whose names start with
smartcc_.
View attack warning logs
After you enable intelligent protection for a website service, the Log Analysis feature of Anti-DDoS Proxy records an attack log whenever a detected malicious attack matches an intelligent protection rule. You can query these attack warning logs in Log Analysis to understand how well intelligent protection works.
Before you run a query, make sure that the Log Analysis feature is enabled for your website domain name. For more information, see Get started with Log Analysis.
Log on to Anti-DDoS Proxy console. On the page, select the domain name and enter the following query statement to view the attack warning logs that are related to intelligent protection.
Replace aliyundoc.com with your actual website domain name.
matched_host:"aliyundoc.com" and cc_action:alarm