Web Application Firewall:Protect app services with bot management

Procedure

Log on to the Web Application Firewall 3.0 console. In the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) for your WAF instance. In the left-side navigation pane, choose Protection Config > Bot Management > Bot Management Template. On the App Protection tab, click Create Template.

Step 1: Define basic information

Enter a recognizable Template Name and Template Description.

Step 2: Configure protection settings

Select a Template Mode. You can use the Smart Scoring Mode or the Custom Mode.

• Smart Scoring Mode: When a request matches a rule, the system automatically scores the request based on built-in rules and takes the specified action, such as block, validation, or monitor. This mode is suitable for quick setup.

• Custom Mode: The system categorizes rules based on Alibaba Cloud's extensive library of bot signatures. You must configure the action for each rule individually. This mode is suitable for fine-grained control.

  Smart Scoring Mode

  1. Select a Protection Scene based on your business needs. If you are unsure, we recommend selecting General Protection.

  2. Select the Traffic Characteristics. You can choose between Global and Customize Match Conditions.

     • Global: Applies to all traffic for the protected object. This is suitable for scenarios that involve only web or H5 environments.

     • Customize Match Conditions: Applies to scenarios where you need to differentiate web or H5 traffic based on its characteristics. For example, your website and an API, app, or mini-program share an endpoint, but you want to protect only the web traffic, or you need fine-grained protection for specific business endpoints such as flash sales or logins.

       Global

       If you select Global, you do not need to define traffic characteristics.

       Customize Match Conditions

       If you select Customize Match Conditions, WAF matches requests based on the characteristics you define. Click Add Condition to add a condition. Each condition consists of a Match Field, a Logical Operator, and the Match Content. The following table provides configuration examples.

       Note

       If a rule has multiple conditions, a request must meet all of them (a logical AND) to match the rule. For more information about match fields and logical operators, see Match conditions.

       Match Field	Logical Operator	Match Content	Description
       URI Path	Contains	/login.php	Matches if the request path contains /login.php.
       IP	Belongs to	192.1.XX.XX	Matches if the client IP address is 192.1.XX.XX.

  3. Select whether to Exclude Static Files. Requests for static files typically do not involve business logic and are less susceptible to injection attacks. Excluding them can reduce the detection load, allowing WAF to focus on protecting dynamic endpoints. We recommend that you use the default static file types, but you can also add custom types.

  4. In the App Repackaging area, click Create to configure a rule. This rule prevents attackers from decompiling your app, embedding malicious code or ads, and then repackaging it as a pirated version to send requests to your server.

     • Specify the legitimate package name and signature in the Valid Package Name and Signature fields, which uniquely identify your app. You can click Add to configure multiple versions, with a maximum of five conditions. The conditions are evaluated with a logical OR relationship.

     • Rule Type: You can classify the rule as a Malicious Bot or Suspected Bot.

     • Actions: For details, see Action descriptions.

     • Canary Rule and Effective Mode: For details, see Rule grayscale and effective mode descriptions.

  5. In the Signature Exception Detection area, you can Edit the rule. This feature verifies the legitimacy and integrity of requests from your mobile app, preventing unauthorized clients from tampering with, forging, or replaying requests. This feature is enabled by default, and we recommend keeping it enabled.

     • Custom Signing Field: If enabled, you must configure the field name and value. The system will then perform a signature check on the specified field.

     • Expired Signature: Select this to enable signature validity checks.

     • Actions: The supported actions are Monitor, Block, and Strict CAPTCHA. For details, see Action descriptions.

     • Canary Rule and Effective Mode: For details, see Rule grayscale and effective mode descriptions.

  6. In the Search Engine Crawler area, you can Edit the rule to allow search engine traffic. This feature is enabled by default, and we recommend keeping it enabled.

     • Select the search engine crawlers that you want to allow.

     • Configure the Canary Rule and Effective Mode as needed. For details, see Rule grayscale and effective mode descriptions.

  7. In the Bot Scoring Range Settings area, you can drag the sliders to define score ranges and their corresponding actions. Configure the following for each range:

     • Actions: We recommend applying progressively stricter actions as the score increases, such as Monitor, CAPTCHA, and then Block. For details, see Action descriptions.

     • Canary Rule and Effective Mode: For details, see Rule grayscale and effective mode descriptions.

  Custom Mode

  1. Select the Traffic Characteristics. You can choose between Global and Customize Match Conditions.

     • Global: Applies to all traffic for the protected object. This is suitable for scenarios that involve only web or H5 environments.

     • Customize Match Conditions: Applies to scenarios where you need to differentiate web or H5 traffic based on its characteristics. For example, your website and an API, app, or mini-program share an endpoint, but you want to protect only the web traffic, or you need fine-grained protection for specific business endpoints such as flash sales or logins.

       Global

       If you select Global, you do not need to define traffic characteristics.

       Customize Match Conditions

       If you select Customize Match Conditions, WAF matches requests based on the characteristics you define. Click Add Condition to add a condition. Each condition consists of a Match Field, a Logical Operator, and the Match Content. The following table provides configuration examples.

       Note

       If a rule has multiple conditions, a request must meet all of them (a logical AND) to match the rule. For more information about match fields and logical operators, see Match conditions.

       Match Field	Logical Operator	Match Content	Description
       URI Path	Contains	/login.php	Matches if the request path contains /login.php.
       IP	Belongs to	192.1.XX.XX	Matches if the client IP address is 192.1.XX.XX.

  2. Select whether to Exclude Static Files. Requests for static files typically do not involve business logic and are less susceptible to injection attacks. Excluding them can reduce the detection load, allowing WAF to focus on protecting dynamic endpoints. We recommend that you use the default static file types, but you can also add custom types.

  3. In the App Repackaging area, click Create to configure a rule. This rule prevents attackers from decompiling your app, embedding malicious code or ads, and then repackaging it as a pirated version to send requests to your server.

     • Specify the legitimate package name and signature in the Valid Package Name and Signature fields, which uniquely identify your app. You can click Add to configure multiple versions, with a maximum of five conditions. The conditions are evaluated with a logical OR relationship.

     • Rule Type: You can classify the rule as a Malicious Bot or Suspected Bot.

     • Actions: For details, see Action descriptions.

     • Canary Rule and Effective Mode: For details, see Rule grayscale and effective mode descriptions.

  4. In the Risk Identification section, you can click Create to create a risk identification rule. Based on WAF's built-in phone number reputation database, this feature blocks access from anomalous phone numbers, such as those associated with scalpers. It is suitable for scenarios like phone number-based logins and registrations.

     Important

     Risk identification is a paid feature. The billing rules are as follows:

     • Billing conditions: You are charged only when a request matches a configured rule.

     • Unit price: USD 0.007/request.

     • Billing method: Pay-as-you-go. Bills are generated daily.

     • Account Extraction: Click Add Account to configure the Account Type and Location. You can add up to five conditions, which are evaluated with a logical OR.

       Example: If a logon request uses the GET method and the request parameters are in the format username=158***&password=***, configure the settings as follows:

       • Location: Select Query Parameters.

       • Parameter Name: Enter username.

       This configuration allows WAF to accurately extract the phone number from the request for subsequent security matching and detection.

     • Risk Tag: Click Add Tag to configure tags. You can add up to five tags, which are evaluated with a logical OR.

       • Suspicious Sock Puppet Account: The phone number is suspected to be from a third-party platform rather than a personal user.

       • Fraud Risk: The phone number is suspected to have a history of fraudulent activity.

       • Spam Registration: The phone number is suspected of being used with illicit tools for user registration, often for future marketing campaigns.

       • Marketing Fraud: The phone number is suspected of being used with illicit tools to exploit marketing promotions, such as registering in bulk to receive coupons.

       • Ticket-Scalping Bot: The phone number is suspected of being used with illicit tools to participate in ticket scalping or other flash sale events.

       The default Risk Level for all tags is High. You can change it to High, Medium-high, or Medium based on your business needs.

     • Actions: For details, see Action descriptions.

     • Canary Rule and Effective Mode: For details, see Rule grayscale and effective mode descriptions.

  5. In the Policy Configurations area, the system provides a categorized library of rules based on Alibaba Cloud's experience with common bot characteristics. You can perform the following actions for a target rule:

     • Enable/Disable: Click the icon in the Status column to enable or disable the rule.

     • Modify a rule: Click Edit to customize the rule. You can set the Actions, Canary Rule, and Effective Mode. For details, see Action descriptions and Rule grayscale and effective mode descriptions.

     • Modify classification: For Malicious Bot and Suspected Bot rules, if the default classification does not meet your business needs, you can change it in the Bot Type column.

Step 3: Select the effective scope

In the Apply To area, select the protected objects or object groups to which you want to apply the template. Click the icon to move them to the Selected area, and then click OK.

Step 4: Integrate the app SDK

Bot protection depends on data collected by the app SDK. Without SDK integration, full protection is not possible. For native app scenarios, WAF provides a dedicated app SDK to enhance security.

After integration, the SDK automatically collects client risk signals, generates a security signature, and attaches it to business requests. WAF then uses this signature to accurately identify and block risky requests.

For your mobile operating system, integrate the app SDK by following the SDK Integration Guide.

Maintenance

• Edit a template

  Click Edit in the Actions column for the target template. Modify the template in the Edit panel.

• Delete a template

  Click Delete in the Actions column for the target template. In the Delete dialog box, confirm the information and click OK.

• Copy a template

  Click Copy in the Actions column for the target template. In the Copy dialog box, confirm the information and click OK.

• Enable or disable a template

  A new template is enabled by default. Click the switch in the Status column of the target template to enable or disable the template.

• View rules

  Click the icon for the target template to view its rule information. You can click the switch in the Status column for a rule to enable or disable it. For enabled rules, you can view their hit trends. If the rule action type is JavaScript Validation, CAPTCHA, or Strict CAPTCHA, you can also view the human verification pass rate.

Actions

Rule grayscale and effective mode

1. In the Canary Rule area, you can configure the percentage of objects to which a rule applies based on different dimensions. After enabling rule grayscale, you must also set the Dimension and Canary Release Proportion. The available Dimension options include: IP, Custom Header, Custom Parameter, Custom Cookie, Session, and App UMID.

   Note

   Rule grayscale takes effect based on the configured Dimension, rather than applying randomly to a percentage of requests. For example, if the Dimension is IP and the Canary Release Proportion is 10%, WAF selects approximately 10% of IP addresses. The rule is then applied to all requests from these selected IP addresses, not to a random 10% of all requests.

2. In the Effective Mode area, select when the rule takes effect.

   • Permanently Effective (Default): The rule is always active when the protection template is enabled.

   • Fixed Schedule: The protection rule is active only during a specified time period.

   • Recurring Schedule: The protection rule is active only during a specified recurring schedule.