After you add your services to an Anti-DDoS Proxy instance for protection, you can query the records and details of the attack events that are detected on the instance, including attack source IP addresses, the attack type distribution, and the distribution of attack source locations. Use this information to apply targeted mitigation settings to the attacked domain name or instance.
Attack event types
Anti-DDoS Proxy reports three types of attack events. The following table describes each type. The event details available for each type are described in Attack event details.
Attack event type | Description |
HTTP Attack | Attackers use your service domain name as the attack target and simulate legitimate user requests to frequently access resource-intensive pages on your web service. This consumes server resources until the server can no longer respond to legitimate service requests. If multiple service domain names are attacked at the same time, a separate attack event is generated for each domain name. |
Advanced TCP/UDP Attack | Attackers use a service port as the attack target and illegitimately occupy the TCP and UDP connection channels of the server. This consumes a large amount of connection resources, prevents the server from processing new connection requests, and disrupts your normal services. If multiple service ports under the same Anti-DDoS Proxy IP address are attacked at the same time, a separate attack event is generated for each port. |
Volumetric Attack | Attackers use the IP address of Anti-DDoS Proxy instances as the attack target and typically use a large number of zombie hosts to send a high volume of service requests at the same time. This flood of traffic overwhelms network devices and servers, causes bandwidth congestion, and makes services unresponsive. If multiple Anti-DDoS Proxy IP addresses are attacked at the same time, a separate event is generated for the volumetric attack on each IP address. Volumetric attacks must reach a traffic threshold before an event is generated. For details, see Considerations. |
Considerations
Before you query attack events, note the following limits and behaviors:
Query window — You can query attack events that occurred within the last 180 days.
Volumetric Attack event generation — To prevent an excessive number of events from disrupting your services, Anti-DDoS Proxy applies a default policy that generates a Volumetric Attack event only when Inbound Traffic exceeds 1 Gbps and Traffic Scrubbing drops 100 Mbps of traffic. If inbound traffic stays below the threshold of the default policy, no attack event is generated.
Alert threshold for low-traffic services — If your service traffic is low, configure a custom alert threshold in the Set Alert Threshold section of the Security Overview page. A custom alert threshold covers the case where the console shows mitigated traffic but no attack event is generated.
Prerequisites
An Anti-DDoS Proxy (Chinese Mainland) or Anti-DDoS Proxy (Outside Chinese Mainland) instance is purchased. For more information, see Purchase an Anti-DDoS Proxy instance.
A website service or non-website service is added to Anti-DDoS Proxy. For more information, see Add websites or Manage forwarding rules.
Query attack event records
Log on to the Anti-DDoS Proxy console.
In the top navigation bar, select the region of your instance.
Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.
Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.
In the left-side navigation pane, choose .
On the Attack Analysis page, select the attack event type and the time range to filter the attack records.
The attack records that match the event type and time range appear in the list.
(Optional) In the Actions column, click View Details to view the details of an attack event.
On the Event Details page, you can click Export Report in the upper-right corner and select Export Image or Export to PDF to save the current event details page as a local file in PNG or PDF format.
(Optional) In the Actions column of an event, click Effect Feedback to submit suggestions or questions about the mitigation of the attack event.
If the query returns no attack records, check whether the time range falls outside the last 180 days and whether the attack traffic reached the event-generation threshold. For details, see Considerations.
Attack event details
Open the section that matches the type of the attack event that you queried. Each section describes the content that the Event Details page provides for that event type and the mitigation settings that you can apply from it.
HTTP attack (web resource exhaustion)
For an HTTP Attack event, you can view the following event details and apply targeted mitigation settings to the attacked domain name.
Basic information
Attack Time: The time when the attack occurred.
Attack Target: The domain name that was attacked. Click Mitigation Settings next to the Attack Target to go to the Protection for Website Services tab and configure mitigation policies for the attacked domain name. For more information, see Protection for Website Services.
Maximum Requests: The peak number of requests during the attack.
Total Received Requests: The total number of requests over a period of time before and after the attack. The time range is calculated based on the following logic:
Start time: Take the actual start time of the DDoS attack, round it to the nearest preceding hour or half-hour mark, and then subtract another 30 minutes. For example, if an attack starts at 11:20, the nearest hour or half-hour mark is 11:00, and 30 minutes earlier is 10:30. If an attack starts at 11:40, the nearest mark is 11:30, and 30 minutes earlier is 11:00.
End time: Take the actual end time of the DDoS attack, round it to the nearest following hour or half-hour mark, and then add another 30 minutes. For example, if an attack ends at 12:20, the nearest mark is 12:30, and 30 minutes later is 13:00. If an attack ends at 12:40, the nearest mark is 13:00, and 30 minutes later is 13:30.
Total Blocked Requests: The number of requests that Anti-DDoS Proxy blocked during this attack event.
The following table describes the other sections of the event details.
Event content | Description |
Attack Mitigation Details | A trend chart of the total inbound QPS and the QPS that triggered mitigation policies in different modules, along with the Effective Time of Policy and Blocked Requests of the triggered policies. You can also set the time range to query in the upper-right corner of this section. Protection modules for website services include Blacklist, Location Blacklist, Frequency Control, Accurate Access Control, and Others (such as failed human-machine verification). |
Blocked Requests by Protection Module | The distribution of the number of attack requests blocked by different protection modules. |
Top 10 Hit Policies | The 10 most frequently hit mitigation policies and their proportions. Click More to view the top 100 hit policies and the proportion of each policy. |
Source Location | The source location distribution of attack requests. You can view the Global distribution (by country) and the Chinese Mainland distribution (by province, city, and district). Click More to view the proportion of requests from different source locations. To block traffic from specific attack source locations, click Mitigation Settings below this section and configure a Location Blacklist for the attacked domain name. For more information, see Location Blacklist. |
URI Requests | The top five most frequently requested URLs, sorted in descending order by the number of requests. Click More to view all requested URLs (that is, the URIs and their domain names) and the proportion of each URL. To limit the request rate for a specific URI, click Mitigation Settings below this section and configure Frequency Control for the attacked domain name. For more information, see Frequency Control. |
URI Response Time | The five URIs with the longest URI response times. The URI response time is the total time from when a client sends a request for the resource represented by a specific URI to when the client finishes receiving and processing the server response. |
Attacker IP Address | The top 10 IP addresses that initiated the most anomalous connections and the locations that the IP addresses belong to. Click More to view information about the top 100 source IP addresses. To block traffic from a specific IP address, click Mitigation Settings below this section and configure a Blacklist and Whitelist for the attacked domain name. For more information, see Blacklist and Whitelist. Note All attack source IP addresses are attacker IP addresses and do not include IP addresses of legitimate requests. |
User-Agent | The top five User-Agents with the highest number of requests. The User-Agent is the browser-related information of the client that initiated the access request, such as the identifier of the browser, the identifier of the rendering engine, and version information. |
Referer | The top five Referers in access requests. The Referer is the source URL of an access request. |
HTTP-Method | The top five request methods in access requests. |
Client TLS Fingerprint | The top five client fingerprints in access requests. A client fingerprint is a value that is identified and calculated from the TLS fingerprint of the client that initiated the access request, by using a proprietary Alibaba Cloud algorithm. It is used for the matching and protection of access requests. |
HTTP/2 Fingerprint | The top five HTTP/2 fingerprints in access requests. They are used for the matching and protection of HTTP/2 access requests. |
JA3 Fingerprint | The top five JA3 fingerprints in access requests. They are used to identify and distinguish between different types of TLS clients, such as web browsers, mobile applications, and malware. |
JA4 Fingerprint | The top five JA4 fingerprints in access requests. The JA4 fingerprint introduces more contextual information and algorithms, such as the browser version and operating system, to reduce the duplication issues that JA3 fingerprints can cause. This allows it to more accurately identify genuine users and impostors and lower the false recognition rate. |
You can click Mitigation Settings below the preceding sections to configure mitigation policies for the different protection modules. For more information, see Protection for Website Services.
You can also use the request data in the preceding table — URI response times, User-Agents, Referers, HTTP methods, and client fingerprints — to configure Frequency Control policies for the attacked domain name.
Advanced TCP/UDP attack (connection flood)
For an Advanced TCP/UDP Attack event, you can view the following event details and apply targeted mitigation settings to the Anti-DDoS Proxy instance.
Event content | Description |
Attack Time | The time when the attack occurred. |
Attack Target | The IP address and port of the attacked Anti-DDoS Proxy instance. Click Mitigation Settings next to the Attack Target to go to the Protection for Infrastructure tab and configure mitigation policies for the attacked instance. For more information, see Protection for Infrastructure. |
Attack Mitigation Details | A trend chart of the New Connections and Concurrent Connections during the attack. You can set the time range to query in the upper-right corner of this section. The new connections trend chart includes data on anomalous connections blocked by different mitigation policies, such as Blacklist, Location Blacklist, and Rate Limit by Source IP (which is divided into New Connections Limit for Source, Concurrent Connections Limit for Source, PPS Limit for Source, and Bandwidth Limit for Source). For more information about how to configure the preceding mitigation policies, see Protection for Infrastructure, Location Blacklist, and Rate Limit by Source IP. The concurrent connections trend chart includes data on Active connections and Inactive connections. |
Attack Source IP Addresses | The top five IP addresses that initiated the most anomalous connections and the locations that the IP addresses belong to. Click More to view information about the top 100 attacker IP addresses. Note All attack source IP addresses are attacker IP addresses and do not include IP addresses of legitimate requests. To block traffic from a specific IP address, configure a Blacklist and Whitelist (IP address-based) for the attacked instance. For more information, see Protection for Infrastructure. |
Attack Type | The protocol type distribution of attack traffic. Click More to view the proportion of requests for different attack types. |
Attack Source Location | The source location distribution of attack requests. Click More to view the proportion of requests from different source locations. To block traffic from specific attack source locations, configure a Location Blacklist for the attacked instance. For more information, see Location Blacklist. |
Volumetric attack
For a Volumetric Attack event, you can view the following event details and apply targeted mitigation settings to the Anti-DDoS Proxy instance.
Event content | Description |
Attack Time | The time when the attack occurred. |
Attack Target | The IP address of the attacked Anti-DDoS Proxy instance. Click Mitigation Settings next to the Attack Target to go to the Protection for Infrastructure tab and configure mitigation policies for the attacked instance. For more information, see Protection for Infrastructure. |
Attack Mitigation Details | bps: A trend chart of the bandwidth of inbound traffic, outbound traffic, and mitigated traffic during the attack. pps: A trend chart of the packets of inbound traffic, outbound traffic, and mitigated traffic during the attack. For the traffic thresholds that must be reached before an event is generated, see Considerations. |
Source IP Address | The top 10 IP addresses that initiated the most requests and the locations that the IP addresses belong to. Click More to view information about the top 100 source IP addresses. Note The source IP addresses include only attacker IP addresses. To block traffic from a specific IP address, click Blacklist Settings below the list and set a Blacklist and Whitelist (IP address-based). For more information, see Protection for Infrastructure. |
Attack Source ISP | The source ISP distribution of attack traffic. Click More to view the proportion of requests from different ISPs. Note This traffic includes only attack traffic. Anti-DDoS Proxy (Outside Chinese Mainland) does not support this data. |
Attack Source Location | The source location distribution of attack traffic. Click More to view the proportion of requests from different source locations. To block traffic from specific attack source locations, click Location Blacklist Settings below this section and configure a Location Blacklist for the attacked instance. For more information, see Location Blacklist. Note This traffic includes only attack traffic. |
Attack Type | The protocol type distribution of inbound traffic. Click More to view the proportion of requests of different types. The inbound traffic includes both attack traffic and normal service traffic. |
Destination Port | The proportion of inbound traffic for each destination port. Click More to view the proportion data for each port. The inbound traffic includes both attack traffic and normal service traffic. |