Impact of and solutions to domain attacks and data transmission abuse - Edge Security Acceleration

Scenarios

Dynamic Content Delivery Network (DCDN) accelerates content delivery and provides basic protection capabilities to ensure the stability of DCDN points of presence (POPs). If no extra security measures are implemented, DCDN cannot identify all attacks or ensure service stability in case of website attacks.

High bills can be generated in the following scenarios:

Scenario 1: Your domain is under attack
If your domain is attacked, you are charged for the bandwidth resources that are consumed to defend against the attacks.
Scenario 2: Your website is abused for data transmission
If your website is abused for data transmission, the bandwidth usage may spike. This is similar to Scenario 1. You are charged for the bandwidth resources that are consumed.

Potential risks: high bills caused by attacks or attack-like activities

During an attack, DCDN bandwidth resources are consumed. Therefore, you are responsible for the resulting traffic and bandwidth fees.
A sudden increase in your bandwidth caused by malicious traffic consumption is similar to an attack. Because this activity consumes the bandwidth resources of or DCDN, you are responsible for the resulting traffic and bandwidth fees.
If your domain is under attack, the domain is added to a sandbox. In this case, DCDN cannot ensure service stability for the accelerated domain. For more information, see Introduction to sandboxes.

Potential consequences: bills that are higher than expected

Malicious attacks or traffic theft can easily lead to high bills, which often exceed your account balance.

and DCDN are pay-as-you-go services. Bill amounts are affected by factors such as the billing cycle (for example, hourly, daily, or monthly) and bill processing delays. For Alibaba Cloud and DCDN, bills are generated with a 3- to 4-hour delay. Therefore, services cannot be immediately suspended when your account balance reaches zero. This may result in an overdue amount, or the overdue amount of a single bill may exceed your service suspension credit limit.

Alibaba Cloud provides service suspension protection. If you enable this feature, DCDN is not suspended before the grace period ends. The grace period or overdraft limit is determined based on your account tier and purchase history. The overdraft limit is reset every month.

Solutions

Alibaba Cloud DCDN products do not provide access control or security protection capabilities by default. Alibaba Cloud DCDN detects sudden increases in customer bandwidth. If abnormal traffic is detected, Alibaba Cloud evaluates whether to apply measures such as traffic throttling or sandboxing to the traffic spike based on the customer's normal business traffic volume and the overall load of the abnormal traffic to ensure network stability for all users. (Traffic throttling or sandboxing is not always triggered. For more information, see "Burst bandwidth/QPS throttling rules" in Usage limits.) Alibaba Cloud is not responsible for any availability issues that result from these measures.
To ensure the stable operation of your services and avoid high bills, we recommend that you enable the protection features and access control configurations described in this topic.

Enable access control

When traffic spikes occur, we recommend that you locate the cause by analyzing the real-time logs. For more information, see Configure real-time log delivery. Then, enable the access control features for the domain name in the console based on the specific cause to avoid unnecessary traffic and bandwidth consumption.

Access control feature	Description
Configure a referer blacklist or whitelist	This feature prevents hotlinking by allowing or blocking requests based on their Referer header. You can configure a whitelist to allow only requests from matching referers or a blacklist to block them. For configuration instructions, see for CDN and Configure a referer blacklist or whitelist for DCDN.
Configure URL signing	The URL signing feature provides a secure and reliable way to prevent resource hotlinking by coordinating Alibaba Cloud DCDN POPs with your origin server. You can refer to Configure URL signing to configure rules that meet your business requirements.
Configure an IP address blacklist or whitelist	After a malicious attack or traffic spike, analyze your , which are configured via real-time log delivery, to identify IP addresses with high access frequency. If you identify malicious IP addresses, you can use the IP address blacklist or whitelist feature to block them. For more information, see for CDN and Configure an IP address blacklist or whitelist for DCDN.
Configure a User-Agent blacklist or whitelist	After a malicious attack or traffic spike, analyze your , configured via real-time log delivery, to check if the malicious activity originates from specific User-Agents. If you identify a malicious User-Agent, you can use the User-Agent blacklist or whitelist feature to block these requests. For more information, see for CDN and Configure a User-Agent blacklist or whitelist for DCDN.

Enable traffic management

We recommend that you use CloudMonitor to configure bandwidth alert rules by service or domain name to monitor the traffic and bandwidth usage. For more information, see Configure alerts. In case of unexpected bandwidth surges, you can also configure bandwidth and request throttling.

Traffic management feature	Description
Set bandwidth throttling	If you need to limit the bandwidth for a domain name that uses Alibaba Cloud /DCDN, and your daily peak bandwidth is greater than 10 Gbps, you can submit a ticket to request a backend configuration. Important The bandwidth throttling limit is applied to the total bandwidth of an accelerated domain across the entire network. To ensure accuracy, the limit must be 10 Gbps or higher. When the bandwidth limit (for example, 10 Gbps) is reached, DCDN throttles the accelerated domain name. This slows down user access speeds (because the speed of each request is reduced) and may also cause packet loss. Bandwidth throttling is triggered based on real-time monitoring data, which has a delay of about 10 minutes. Therefore, throttling may begin only after the domain's bandwidth has already exceeded the limit.
Set up real-time monitoring	If you want to monitor the peak bandwidth of a domain name in real time, you can use the Cloud Product Monitoring feature of CloudMonitor to set up monitoring for the peak bandwidth of a specified domain name for or DCDN. When the configured peak bandwidth is reached, an alert (SMS, email, or DingTalk) is sent to the administrator, which helps you detect potential risks in a more timely manner. For more information, see the CloudMonitor product details page.
Set up spending and cost alerts	In the top navigation bar of the console, choose Expenses > Expenses and Costs. Configure the following features to better control your account spending and avoid high bills. Low balance alert: You can set an alert to be sent by SMS when your account balance falls below a specified amount. High bill alert: You can enable an alert that sends an SMS notification if a daily bill for a product exceeds a specified threshold. Note To ensure the completeness of metering data and the accuracy of bills, and DCDN products require approximately 3 hours after a billing cycle ends to generate a final bill. Therefore, there is a delay between the resource consumption time and the actual payment deduction, and bills cannot provide real-time feedback on resource usage. This is determined by the distributed nature of and DCDN points of presence (POPs). All and DCDN service providers use a similar method.