Web Application Firewall:Protect web applications with bot management

Procedure

Log on to the Web Application Firewall (WAF) 3.0 console. In the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) of your WAF instance. In the left-side navigation pane, choose Protection Config > Bot Management > Bot Management Template. On the Web Protection > Protection Template tab, click Create Template.

Step 1: Define basic information

1. Enter an easy-to-identify Template Name and Template Description.

2. Select whether to Save as Default Template. The Web Protection module of bot management allows only one default template. The default template is automatically applied to newly added protected objects or object groups, and Web SDK integration is automatically configured for them.

Step 2: Configure the protection scenario

Select a Template Mode. The Smart Scoring Mode and Custom Mode are supported.

• Smart Scoring Mode: When a request matches a rule, the system automatically scores the request based on built-in rules and takes the specified action, such as block, validation, or monitor. This mode is suitable for quick setup.

• Custom Mode: The system categorizes rules based on Alibaba Cloud's extensive library of bot signatures. You must configure the action for each rule individually. This mode is suitable for fine-grained control.

  Smart Scoring Mode

  1. Select a Protection Scene based on your business needs. If you are unsure, we recommend that you select General Protection.

  2. Select the Traffic Characteristics. Global and Customize Match Conditions are supported.

     • Global: Applies to all traffic for the protected object. This is suitable for scenarios that involve only web or H5 environments.

     • Customize Match Conditions: Applies to scenarios where you need to differentiate web or H5 traffic based on its characteristics. For example, your website and an API, app, or mini-program share an endpoint, but you want to protect only the web traffic, or you need fine-grained protection for specific business endpoints such as flash sales or logins.

       Global

       If you select Global, you do not need to define traffic characteristics.

       Customize Match Conditions

       If you select Customize Match Conditions, WAF matches requests based on the characteristics you define. Click Add Condition to add a condition. Each condition consists of a Match Field, a Logical Operator, and the Match Content. The following table provides configuration examples.

       Note

       If a rule has multiple conditions, a request must meet all of them (a logical AND) to match the rule. For more information about match fields and logical operators, see Match conditions.

       Match Field	Logical Operator	Match Content	Description
       URI Path	Contains	/login.php	Matches if the request path contains /login.php.
       IP	Belongs to	192.1.XX.XX	Matches if the client IP address is 192.1.XX.XX.

  3. Select whether to Exclude Static Files. Requests for static files typically do not involve business logic and are less susceptible to injection attacks. Excluding them can reduce the detection load, allowing WAF to focus on protecting dynamic endpoints. We recommend that you use the default static file types, but you can also add custom types.

  4. In the Human-Machine Challenge area, you can Edit the verification rules. This feature is enabled by default, and we recommend that you keep it enabled.

     1. Select a verification mode. JavaScript Validation and Token-based Authentication are supported.

        • JavaScript Validation: Suitable for low-intensity daily protection scenarios.

        • Token-based Authentication: Suitable for high-intensity adversarial scenarios. We recommend that you enable this mode during critical protection periods, such as a few minutes before a major sales promotion begins.

          JavaScript Validation

          When a request triggers a rule, WAF returns JavaScript validation code to the client. A standard browser executes this code automatically. If the client passes the validation, WAF allows all subsequent requests from that client for a set period (default: 30 minutes). Otherwise, the requests are blocked.

          Token-based Authentication

          When a request triggers a rule, WAF returns JavaScript code. A standard browser executes this code to sign and resend the request. WAF blocks malicious requests that lack the required signature. You can configure the following options:

          • Signature Timestamp Exception: Blocks requests if the signature timestamp is anomalous.

          • WebDriver Attack: Blocks requests if a WebDriver attack is detected.

     2. If required, configure Canary Rule and Effective Mode. For more information, see Canary release and effective mode.

  5. In the Search Engine Crawler area, you can Edit the allow rules for search engines. This feature is enabled by default, and we recommend that you keep it enabled.

     1. Select the search engine crawlers that you want to allow.

     2. If required, configure Canary Rule and Effective Mode. For more information, see Canary release and effective mode.

  6. In the Bot Scoring Range Settings area, drag the sliders to set the score ranges and their corresponding actions. Configure the following for each range:

     1. Actions: We recommend that you apply progressively stricter actions for higher score ranges, such as monitor, slider CAPTCHA, and block. For more information, see Description of actions.

     2. Canary Rule and Effective Mode: For more information, see Canary release and effective mode.

  Custom Mode

  1. Select the Traffic Characteristics. Global and Customize Match Conditions are supported.

     • Global: Applies to all traffic for the protected object. This is suitable for scenarios that involve only web or H5 environments.

     • Customize Match Conditions: Applies to scenarios where you need to differentiate web or H5 traffic based on its characteristics. For example, your website and an API, app, or mini-program share an endpoint, but you want to protect only the web traffic, or you need fine-grained protection for specific business endpoints such as flash sales or logins.

       Global

       If you select Global, you do not need to define traffic characteristics.

       Customize Match Conditions

       If you select Customize Match Conditions, WAF matches requests based on the characteristics you define. Click Add Condition to add a condition. Each condition consists of a Match Field, a Logical Operator, and the Match Content. The following table provides configuration examples.

       Note

       If a rule has multiple conditions, a request must meet all of them (a logical AND) to match the rule. For more information about match fields and logical operators, see Match conditions.

       Match Field	Logical Operator	Match Content	Description
       URI Path	Contains	/login.php	Matches if the request path contains /login.php.
       IP	Belongs to	192.1.XX.XX	Matches if the client IP address is 192.1.XX.XX.

  2. Select whether to Exclude Static Files. Requests for static files typically do not involve business logic and are less susceptible to injection attacks. Excluding them can reduce the detection load, allowing WAF to focus on protecting dynamic endpoints. We recommend that you use the default static file types, but you can also add custom types.

  3. In the Human-Machine Challenge area, you can Edit the verification rules. This feature is enabled by default, and we recommend that you keep it enabled.

     1. Select a verification mode. JavaScript Validation and Token-based Authentication are supported.

        • JavaScript Validation: Suitable for low-intensity daily protection scenarios.

        • Token-based Authentication: Suitable for high-intensity adversarial scenarios. We recommend that you enable this mode during critical protection periods, such as a few minutes before a major sales promotion begins.

          JavaScript Validation

          When a request triggers a rule, WAF returns JavaScript validation code to the client. A standard browser executes this code automatically. If the client passes the validation, WAF allows all subsequent requests from that client for a set period (default: 30 minutes). Otherwise, the requests are blocked.

          Token-based Authentication

          When a request triggers a rule, WAF returns JavaScript code. A standard browser executes this code to sign and resend the request. WAF blocks malicious requests that lack the required signature. You can configure the following options:

          • Signature Timestamp Exception: Blocks requests if the signature timestamp is anomalous.

          • WebDriver Attack: Blocks requests if a WebDriver attack is detected.

     2. If required, configure Canary Rule and Effective Mode. For more information, see Canary release and effective mode.

  4. In the Risk Identification section, you can click Create to create a risk identification rule. Based on WAF's built-in phone number reputation database, this feature blocks access from anomalous phone numbers, such as those associated with scalpers. It is suitable for scenarios like phone number-based logins and registrations.

     Important

     Risk identification is a paid feature. The billing rules are as follows:

     • Billing conditions: You are charged only when a request matches a configured rule.

     • Unit price: USD 0.007/request.

     • Billing method: Pay-as-you-go. Bills are generated daily.

     • Account Extraction: Click Add Account to configure the Account Type and Location. You can add up to five conditions, which are evaluated with a logical OR.

       Example: If a logon request uses the GET method and the request parameters are in the format username=158***&password=***, configure the settings as follows:

       • Location: Select Query Parameters.

       • Parameter Name: Enter username.

       This configuration allows WAF to accurately extract the phone number from the request for subsequent security matching and detection.

     • Risk Tag: Click Add Tag to configure tags. You can add up to five tags, which are evaluated with a logical OR.

       • Suspicious Sock Puppet Account: The phone number is suspected to be from a third-party platform rather than a personal user.

       • Fraud Risk: The phone number is suspected to have a history of fraudulent activity.

       • Spam Registration: The phone number is suspected of being used with illicit tools for user registration, often for future marketing campaigns.

       • Marketing Fraud: The phone number is suspected of being used with illicit tools to exploit marketing promotions, such as registering in bulk to receive coupons.

       • Ticket-Scalping Bot: The phone number is suspected of being used with illicit tools to participate in ticket scalping or other flash sale events.

       The default Risk Level for all tags is High. You can change it to High, Medium-high, or Medium based on your business needs.

     • Rule Type: Classify the rule as Suspected Bot or Malicious Bot.

     • Actions: For more information, see Description of actions.

     • Canary Rule and Effective Mode: For more information, see Canary release and effective mode.

  5. In the Policy Configurations area, rules are categorized based on Alibaba Cloud's bot signature library. For a specific rule, you can perform the following operations:

     • Enable/Disable: Click the icon in the Status column to enable or disable the rule.

     • Modify rule: Click Edit to customize the rule. Set the Actions, Canary Rule, and Effective Mode. For more information, see Description of actions and Canary release and effective mode.

     • Modify classification: For rules in the Malicious Bot and Suspected Bot categories, you can modify the classification in the Bot Type column if the default classification does not meet your business requirements.

     • Configuration recommendations:

       Important

       • Risk of false positives: Some of the following rules carry a risk of false positives, and improper configuration may cause legitimate requests to be blocked. Before you enable the rules in a production environment, we recommend that you set the Actions to Monitor or use Canary Rule. Test and fine-tune the rules in a non-production environment based on your business characteristics before you deploy them to production.

       • Notes on CC-like rule statistics: All CC counting rules, such as Few Access Paths from IP Address, trigger an immediate action once the threshold is reached within the configured statistical period. The system does not wait for the statistical period to end. After an object is added to the blacklist, if requests from the object continue to trigger the rule, the system continues to count the requests and refreshes the object's blacklist timeout period.

     • Abnormal Browser Probe

       Rule name	False positive risk
       Developer tools, emulator tools	Low
       Anomalous browser environment	Low
       Automation tools, headless browsers	Low
       Anomalous system environment	Low. May affect some users on Windows XP.
       Anomalous timestamp	Medium. May block requests submitted from a webpage that has been open for more than 2 hours without being refreshed.
       Anomalous Web SDK version	Low. May affect users with older, manually integrated versions of the Web SDK.

     • Device Spoofing

       Rule name	False positive risk
       Device hardware information spoofing, browser attribute spoofing, operating system and environment spoofing	Low
       Collected information spoofing, network and geolocation spoofing	Low. False positives can occur if a Layer 7 proxy, such as CDN or Anti-DDoS, is deployed in front of WAF and is not configured to forward the original client IP address.

     • Crawler Client

       Rule name	False positive risk
       Python tool traffic	Low
       Crawler tool traffic	Low

     • Abnormal Behavior

       Rule name	False positive risk
       All rules	Medium. May block users with low mouse sensitivity.

     • Script Client

       Rule name	False positive risk
       All rules	Low. The impact depends on your business. For example, the OkHttp tool traffic rule cannot be enabled in a native app environment. The Dart tool traffic rule cannot be enabled if your business is associated with Flutter.

     • IDC

       Rule name	False positive risk
       All rules	Medium. May block legitimate traffic, such as payment callbacks or access from Alibaba Cloud Workspace. False positives can also occur if a Layer 7 proxy in front of WAF is not configured to forward the original client IP address.

     • Threat Intelligence

       Rule name	False positive risk
       Forged search engine spiders	Low
       Crawler threat intelligence IP library, Crawler threat intelligence fingerprint library	Medium. False positives can occur in networks with shared public egress IP addresses (such as residential or corporate networks) or if a Layer 7 proxy in front of WAF is not configured to forward the original client IP. We recommend that you set the action to slider CAPTCHA or JavaScript validation.

     • AI-Powered Protection

       Rule name	False positive risk
       Anomalous path sequence, Anomalous device, Malicious gang behavior, Anomalous resource distribution, Time-series anomaly	Medium. False positives can occur in networks with shared public egress IP addresses (such as residential or corporate networks) or if a Layer 7 proxy in front of WAF is not configured to forward the original client IP. We recommend that you set the action to slider CAPTCHA or JavaScript validation.
       Anomalous session	High. False positives can occur in networks with shared public egress IP addresses (such as residential or corporate networks) or if a Layer 7 proxy in front of WAF is not configured to forward the original client IP. We recommend that you set the action to slider CAPTCHA or JavaScript validation.

     • Abnormal Access Behavior

       Rule name	False positive risk
       Persistent access without collected information, Persistent access without session	Low. Web SDK integration is required. Otherwise, no information is collected.
       Bulk replay of interaction trajectories	Low
       Frequent IP changes for the same session, Frequent IP changes for the same device	Low
       Few IP access paths, Many IP access paths, Frequent changes in client types, Frequent UA changes for the same IP	Medium. False positives can occur in networks with shared public egress IP addresses (such as residential or corporate networks) or if a Layer 7 proxy in front of WAF is not configured to forward the original client IP address. We recommend that you set the action to slider CAPTCHA or JavaScript validation.

     • Search Engine Crawler Client

       Rule name	False positive risk
       All rules	We recommend that you keep the default configuration to allow these requests.

Step 3: Select the scope

In the Apply To area, select the protected objects or object groups, move them to the Selected area by clicking the icon, and then click OK.

Maintenance

• Edit a template

  Click Edit in the Actions column for the target template. Modify the template in the Edit panel.

• Delete a template

  Click Delete in the Actions column for the target template. In the Delete dialog box, confirm the information and click OK.

• Copy a template

  Click Copy in the Actions column for the target template. In the Copy dialog box, confirm the information and click OK.

• Enable or disable a template

  A new template is enabled by default. Click the switch in the Status column of the target template to enable or disable the template.

• View rules

  Click the icon for the target template to view its rule information. You can click the switch in the Status column for a rule to enable or disable it. For enabled rules, you can view their hit trends. If the rule action type is JavaScript Validation, CAPTCHA, or Strict CAPTCHA, you can also view the human verification pass rate.

Actions

Canary release and effective mode

1. In the Canary Rule area, you can configure the percentage of traffic that is affected by the rule based on a dimension. After you enable canary release, you must set a Dimension and a Canary Release Proportion. The available options for Dimension are IP, Custom Header, Custom Parameter, Custom Cookie, Session, and Web UMID.

   Note

   A canary release takes effect based on the configured Dimension, not by randomly applying the rule to a percentage of requests. For example, if the Dimension is IP and the Canary Release Proportion is 10%, WAF selects approximately 10% of the IP addresses. The rule is then applied to all requests from these selected IP addresses, not to a random 10% of total requests.

2. In the Effective Mode area, select when the rule takes effect.

   • Permanently Effective (Default): The rule is always active when the protection template is enabled.

   • Fixed Schedule: The protection rule is active only during a specified time period.

   • Recurring Schedule: The protection rule is active only during a specified recurring schedule.

FAQ