Alibaba Cloud provides 500 Mbps to 5 Gbps of free Anti-DDoS Basic mitigation capacity for selected cloud services. Anti-DDoS Basic defends against common network-layer and transport-layer DDoS attacks. This topic describes what Anti-DDoS Basic is.
Product overview
Anti-DDoS Basic is a free security service built into Alibaba Cloud. It provides free DDoS mitigation for assets that are assigned public IP addresses, such as Elastic Compute Service (ECS) instances, Server Load Balancer (SLB) instances, and elastic IP addresses (EIPs). After you rent a server on Alibaba Cloud or activate a cloud service that has a public IP address, Anti-DDoS Basic takes effect automatically. It provides network-layer and transport-layer attack defense and traffic scrubbing, with no additional purchase or configuration required. Anti-DDoS Basic is enabled by default and cannot be disabled. The free DDoS mitigation capability is 500 Mbps to 5 Gbps. For the specific mitigation capability of each cloud service, see View the thresholds that trigger blackhole filtering in Anti-DDoS Basic.
If a resource is frequently attacked, the platform adjusts its mitigation capability based on your historical attack records to maintain overall platform stability.
Under normal circumstances, Anti-DDoS Basic generally does not affect your normal access. However, access may be affected by attack methods (such as HTTP_Flood, SYN_Flood, and ACK_Flood attacks), attack vectors, and your own service scenarios (such as traffic that exceeds platform or product specifications). If Anti-DDoS Basic does not meet your requirements, you can use higher-level protection services such as Anti-DDoS Native or Anti-DDoS Proxy. For more information, see What is Anti-DDoS Native?, What is Anti-DDoS Proxy?, and How to select an Anti-DDoS product.
How it works
Anti-DDoS Basic applies a default scrubbing threshold, and you can also configure a custom scrubbing threshold. When the traffic scrubbing conditions are met, Anti-DDoS Basic filters and scrubs all traffic from the Internet. This defends against common network-layer and transport-layer attacks, such as UDP reflection attacks and SYN/ACK Flood attacks. Anti-DDoS Basic does not defend against application-layer attacks, such as HTTP Flood attacks and CC attacks.
Anti-DDoS Basic uses two methods to determine when to trigger traffic scrubbing: the BPS/PPS scrubbing thresholds that you configure and an AI-powered intelligent analysis. By leveraging Alibaba Cloud's big data capabilities, the system learns your service's traffic baseline and uses algorithms to identify attack patterns. Traffic scrubbing is triggered only when the AI analysis detects a DDoS attack and the inbound traffic exceeds your configured BPS or PPS threshold. This dual-check mechanism helps prevent false positives, which can occur if a normal traffic spike exceeds a fixed threshold.
If the inbound traffic exceeds the mitigation capability (the blackhole triggering threshold), the cloud service is added to a blackhole. This prevents a DDoS attack from causing greater damage to the cloud service and prevents an attack on one cloud service from affecting the normal operation of other assets. In a blackhole, Alibaba Cloud temporarily blocks the inbound Internet traffic of the cloud service. For more information, see Alibaba Cloud blackhole filtering policy.
Supported cloud services
Elastic Compute Service (ECS) instances, Server Load Balancer (SLB) instances, elastic IP addresses (EIPs), EIPs that are associated with a NAT gateway, IPv6 gateways, simple application servers, Web Application Firewall (WAF) instances, Global Accelerator (GA) instances, and Anycast EIPs.
Supported regions
The following table lists the regions that Anti-DDoS Basic supports.
Area | Region |
Asia Pacific | Thailand (Bangkok), Philippines (Manila), Japan (Tokyo), Indonesia (Jakarta), Malaysia (Kuala Lumpur), South Korea (Seoul), Singapore, China (Hong Kong), China (Chengdu), China (Guangzhou), China (Heyuan), China (Shenzhen), China (Ulanqab), China (Hohhot), China (Zhangjiakou), China (Beijing), China (Qingdao), China (Shanghai), China (Hangzhou) |
Europe and Americas | UK (London), Germany (Frankfurt), US (Virginia), and US (Silicon Valley) |
Middle East | SAU (Riyadh) and UAE (Dubai) |
Terms
Network-layer attacks: Common types include UDP reflection attacks, high-volume SYN Flood attacks, ACK Flood attacks, and malformed packets that do not conform to the IP protocol. These attacks consume server bandwidth resources to cause a denial of service.
Application-layer attacks: Common types include HTTP Flood attacks, CC attacks, and DNS Flood attacks. These are exhaustion attacks based on service characteristics. They consume server processing capacity to cause a denial of service.
FAQ
Why is my instance targeted by DDoS attacks?
DDoS attacks, such as volumetric attacks, are common malicious behavior on the Internet. Attackers control large botnets and send massive volumes of malicious traffic to a target to exhaust its bandwidth resources, which prevents legitimate users from accessing it.
Any IP asset that is exposed to the Internet can become a DDoS attack target. DDoS attacks are not aimed only at specific users or specific services. Common reasons for a DDoS attack include:
Your service has high visibility on the Internet and is easy for attackers to find.
Targeted attacks driven by industry competition or malicious retaliation.
Your server IP address is randomly scanned by attackers and added to an attack list.
Anti-DDoS Basic automatically detects unusual traffic and starts traffic scrubbing to filter out attack traffic and protect normal service access. If the attack traffic exceeds the mitigation capability of Anti-DDoS Basic, upgrade to Anti-DDoS Native or Anti-DDoS Proxy for a higher level of protection.
Does Anti-DDoS Basic block UDP packets and traffic?
By default, Anti-DDoS Basic blocks oversized UDP packets and fragmented UDP traffic. Because UDP reflection attacks usually use large or fragmented packets to amplify attack traffic, Anti-DDoS Basic can effectively defend against these attacks by filtering and blocking such traffic.
However, this blocking mechanism may affect normal services that rely on large UDP packets or fragmented UDP transmission. For example, if large or fragmented UDP traffic is blocked, a video surveillance service that uses the GB28181 protocol for national-standard cascading may experience issues such as cascading failures or interrupted video streams.
If your service must use large UDP packets or fragmented UDP traffic, upgrade to an advanced mitigation service that supports a custom UDP protection policy, such as Anti-DDoS Proxy. This prevents legitimate service traffic from being blocked by mistake. For more information, see What is Anti-DDoS Native?.
References
The maximum scrubbing threshold that each cloud service supports depends on the specifications of the cloud service instance. For more information, see Cloud service specifications and scrubbing thresholds.
To learn how to configure a scrubbing threshold, see Configure traffic scrubbing thresholds.