How to select a protection product after a DDoS attack - Anti-DDoS

The Alibaba Cloud Anti-DDoS product matrix is designed to protect your business against various types of DDoS attack and to ensure service continuity and stability. Because attacks differ and business scenarios vary, selecting the right protection solution is critical. This topic serves as your decision guide. It helps you quickly understand the core concepts and follow a scenario-based selection path to find the Anti-DDoS product that best fits your business.

Core concepts

Understanding the following core concepts is the basis for making the right selection decisions.

Key terms

Term	Description
DDoS attack	Short for a distributed denial-of-service attack(DDoS), which is a common type of network security attack. This type of attack mainly consumes the resources of a network or a network device by using malicious traffic, which causes a website to run abnormally or an online service to become unavailable. For more information, see What is a DDoS attack?.
blackhole	A traffic blocking mechanism. When the volume of attack traffic that targets an IP address exceeds the Anti-DDoS Basic mitigation capacity of that address, the carrier discards all traffic to the IP address, including legitimate access traffic. This protects the overall stability of the Alibaba Cloud network. As a result, the services on the IP address are completely interrupted for a period of time. Purchasing a higher level of protection service, such as Anti-DDoS Proxy, is an effective way to deactivate blackhole filtering.
traffic scrubbing	A series of detection and identification algorithms separate malicious attack traffic from normal service traffic and discard the malicious traffic. Only clean service traffic is forwarded back to the origin server, which ensures service availability.

Product definitions

Anti-DDoS Basic: a free basic protection service that is provided for some Alibaba Cloud services. It can defend against small-scale attacks, but its mitigation capability is limited (500 Mbps to 5 Gbps). When attack traffic exceeds the threshold, the attacked IP address is blackholed, which interrupts your services.
Anti-DDoS Native: a security product that directly improves the DDoS defense capability of Alibaba Cloud services. It is simple to deploy and requires no changes to your network architecture or your service IP addresses. It mainly defends against Layer 3 and Layer 4 volumetric DDoS attacks.
Anti-DDoS Proxy: a proxy-based protection service. It uses DNS resolution to redirect service traffic to DDoS scrubbing centers around the world for traffic scrubbing, which effectively hides the IP addresses of your origin servers. It provides comprehensive defense against network-layer, transport-layer, and application-layer DDoS attacks, including HTTP/HTTPS CC attacks.

Protection solution details

Note

If you need a customized security solution, such as an ultra-large specification or application-layer UDP protection, you can call your business manager for a consultation.

Product comparison

Dimension	Anti-DDoS Basic	Anti-DDoS Native		Anti-DDoS Proxy
Dimension	Anti-DDoS Basic	Regular Alibaba Cloud services	Anti-DDoS Advanced EIP	Anti-DDoS Proxy
Scenarios	Cost-sensitive. Non-core services that can tolerate brief interruptions. Attacks are small in scale.	The number of ports and IP addresses is large. High clean bandwidth (for example, clean bandwidth greater than 1 Gbps, and clean queries per second (QPS) greater than 5,000 for HTTP and HTTPS services), and the public-facing IP addresses cannot be changed. Ultra-low latency is required to ensure service continuity during volumetric attacks. DDoS attacks occur occasionally.		Attacks are frequent and the attack-and-defense campaigns are intense. Defense against sophisticated application-layer flood attacks is required. The public-facing IP addresses of your services need to be changed.
Billing	Free.	Subscription (upfront): available in Anti-DDoS Native (SMB) and Anti-DDoS Native (Enterprise). For more information, see Anti-DDoS Native 2.0 (Subscription). Note Only Anti-DDoS Native (Enterprise) supports Anti-DDoS Advanced EIP. Pay-as-you-go (postpaid): for more information, see [Existing customers] Anti-DDoS Native 2.0 (Pay-as-you-go).		Instance fee (upfront): paid monthly or yearly based on the specifications that you select, such as the basic protection bandwidth, clean bandwidth, and QPS. Elastic protection fee (postpaid): charged daily based on the actual peak of attack traffic, and applies only when DDoS attack traffic exceeds the basic protection bandwidth. Burstable clean bandwidth/QPS fee (postpaid): charged by the daily or monthly 95th percentile, and applies only when normal service traffic or QPS exceeds the basic specification. Advanced mitigation resource plan: for a specific instance, you can also purchase an advanced mitigation resource plan on demand. For more information, see Billing.
Core mechanism	Built into the cloud service. Traffic discarding (blackhole) is automatically triggered when the traffic exceeds the threshold, which ensures the stability of the cloud service provider network.	Associated directly with cloud resources without changing your service IP addresses, and performs traffic scrubbing when an attack exceeds the threshold.		Redirects traffic to a dedicated scrubbing center by modifying DNS resolution. All traffic undergoes traffic scrubbing before it is forwarded, which ensures the availability of the origin server.
Access method	Automatically enabled. No manual operation is required.	Associate protected objects in the console.		You must modify DNS resolution to redirect traffic to the IP address of the Anti-DDoS Proxy instance.
Protected objects	Some Alibaba Cloud services, including Elastic Compute Service (ECS) instances, Server Load Balancer (SLB) instances, elastic IP addresses (EIPs), EIPs that are associated with a NAT gateway, IPv6 gateways, simple application servers, Web Application Firewall (WAF) instances, Global Accelerator (GA) instances, and Anycast EIPs..	Some Alibaba Cloud services, including Elastic Compute Service (ECS) instances, Server Load Balancer (SLB) instances, elastic IP addresses (EIPs), EIPs that are associated with a NAT gateway, IPv6 gateways, simple application servers, Web Application Firewall (WAF) instances, Global Accelerator (GA) instances, and Anycast EIPs..	Only Anti-DDoS Advanced EIPs are supported.	Any public IP address.
Mitigation capabilities	Low. Based on the defense capability within Alibaba Cloud, 500 Mbps to 5 Gbps. For more information, see View the thresholds that trigger blackhole filtering in Anti-DDoS Basic.	Moderate. Based on the defense capability within Alibaba Cloud, up to hundreds of Gbps. For more information, see What is Anti-DDoS Native?.	High. Based on the capability of the Alibaba Cloud global DDoS scrubbing centers, up to more than 1 Tbps.	High. Based on the capability of the Alibaba Cloud global DDoS scrubbing centers, up to more than 1 Tbps.

Comparison of defended DDoS attack types

Attack type	Description	Anti-DDoS Native		Anti-DDoS Proxy
Attack type	Description	Regular Alibaba Cloud services	Anti-DDoS Advanced EIP	Anti-DDoS Proxy
Network layer DDoS attacks	Mainly includes Frag Flood, Smurf, Stream Flood, Land Flood, malformed IP packets, malformed TCP packets, and malformed UDP packets.	Supported	Supported	Supported
Transport layer DDoS attacks	Mainly includes SYN Flood, ACK Flood, UDP Flood, ICMP Flood, RST Flood, NTP reflection, SSDP reflection, and DNS reflection.	Supported	Supported	Supported
Application layer DDoS attacks (HTTP/HTTPS)	Also known as web application-layer flood attacks. Mainly includes CC attacks that target HTTP services, such as HTTP/HTTPS CC attacks and HTTP slow-rate attacks (LOIC/HOIC/Slowloris/Pyloris/XOIC). Examples of these services are websites, API operations, and WebSocket services.	Unsupported	Unsupported	Supported
Application layer DDoS attacks (non-HTTP/HTTPS TCP application-layer protocols)	Also known as non-web application-layer flood attacks. Mainly includes TCP application-layer CC attacks that target non-HTTP services, such as TCP CC attacks, TCP Empty Connection attacks, and TCP connection resource exhaustion attacks. Examples of these services are private protocols, MySQL, MQTT, and RTMP services.	Unsupported	Supported Note In public preview. Only the China (Hangzhou) region is supported.	Supported
Application layer DDoS attacks (UDP-based application-layer protocols)	CC attacks that target UDP services, such as UDP-CC attacks and DNS-Flood attacks against NS services. Examples of these services are NS services, UDP gaming services, and UDP voice call services. Important CC protection for UDP services requires the additional purchase of Managed Security Service. Otherwise, this protection is not supported.	Supported Note Supports traffic scrubbing for DNS attacks against non-NS services. To protect NS services, use DNS protection.

Protection effectiveness notes

DDoS attack patterns keep evolving. The intelligent AI engine that is built into the Anti-DDoS protection solution learns and models normal service traffic to identify attacks accurately.
In addition, if your services suffer a DDoS attack or a CC attack immediately after they are onboarded, instantaneous attack pass-through may occur. The following mitigation settings are provided:
- Anti-DDoS Native:
  - Customize various mitigation policies in advance, such as inline protection, port protection, and trigger-based protection, to improve protection effectiveness. For instructions, see Mitigation Settings.
  - Adjust the traffic scrubbing threshold based on your service traffic. For instructions, see Configure traffic scrubbing thresholds.
- Anti-DDoS Proxy:
  - Provides fine-grained policies based on business scenarios (Scenario-specific policies).
  - Combine custom frequency-based mitigation policies according to your service characteristics (for example, Configure HTTP flood protection).