Web Application Firewall:ボット管理による Web アプリケーションの保護

操作手順

WAF 3.0 コンソールにログインします。上部メニューで、WAF インスタンスのリソースグループとリージョン ([中国本土]または[中国本土以外]) を選択します。左側ナビゲーションペインで、保護設定 > BOT 管理 > Bot 管理テンプレート を選択します。Web 保護 > 防護テンプレート タブで、テンプレートを作成 をクリックします。

ステップ 1：保護シナリオの定義

1. テンプレート名 と テンプレートの紹介 を入力します。

2. 保護ターゲットの特性 を選択します。グローバル と マッチ条件のカスタマイズ から選択できます。

   • グローバル：Web または H5 環境のみを含むシナリオに適用されます。

   • マッチ条件のカスタマイズ：Web または H5 環境に加えてアプリまたはミニアプリ環境を含むシナリオ、またはログインやフラッシュセールなどの特定のビジネスエンドポイントを保護する必要があるシナリオに適用されます。

     [グローバル]

     [グローバル] を選択した場合、特定の一致条件を定義する必要はありません。

     [マッチ条件のカスタマイズ]

     WAF は、定義した条件に基づいてリクエストを照合します。条件の追加 をクリックして条件を追加します。各条件は、マッチフィールド、論理記号、および マッチコンテンツ で構成されます。次の表に設定例を示します。

     説明

     ルールに複数の条件がある場合、リクエストがルールに一致するには、すべての条件 (論理 AND) を満たす必要があります。詳細については、「一致条件」をご参照ください。

     [マッチフィールド]	[論理記号]	[マッチコンテンツ]	説明
     URI パス	含む	/login.php	リクエストパスに /login.php が含まれている場合に一致します。
     IP	属する	192.1.XX.XX	Matches if the client IP is 192.1.XX.XX.

3. 静的ファイルの除外 を行うかどうかを選択します。静的ファイルへのリクエストは通常、ビジネスロジックを伴わず、そのコンテンツはインジェクション攻撃の影響を受けにくいです。静的ファイルを除外することで、検出の負荷を軽減し、WAF が動的 API の保護に集中できるようになります。デフォルトの静的ファイルタイプを選択することをお勧めします。カスタムタイプを追加することもできます。

ステップ 2: テンプレートルールの編集

1. In the [CAPTCHA 検証] section, click [編集] to configure the CAPTCHA rules.

   1. Select a verification mode. [JS 検証] and [トークンチャレンジ] are supported.

      • [JS 検証]: Suitable for low-intensity daily protection scenarios.

      • [トークンチャレンジ]: Suitable for high-intensity adversarial scenarios. We recommend enabling this mode during critical protection periods, such as a few minutes before a major sales promotion.

        [JS 検証]

        When a rule is triggered, WAF returns a block of JavaScript code. A standard browser client executes the code to obtain a pass token and resends the request. Malicious traffic is blocked because it does not carry the pass token. Once authenticated, the client can make subsequent requests for a set period (30 minutes by default) without further verification.

        [トークンチャレンジ]

        When a rule is triggered, WAF returns a block of JavaScript code. A standard browser client executes the code to sign the request and resend it. WAF blocks malicious requests that lack the required signature. Options include the following:

        • [署名タイムスタンプの例外]: Blocks requests if the signature timestamp is abnormal.

        • [WebDriver 攻撃]: Blocks requests if a WebDriver attack is detected.

   2. In the [規則的グレースケール] section, you can configure the percentage of traffic that is affected by the rule based on a dimension. After you enable canary release, you must set a [ディメンション] and a [グレースケール]. The available options for [ディメンション] are [IP], [カスタムヘッダ], [Custom Parameter], [カスタム Cookie], [Session], and [Web 側の UMID].

      説明

      A canary release takes effect based on the configured [ディメンション], not by randomly applying the rule to a percentage of requests. For example, if the [ディメンション] is [IP] and the [グレースケール] is 10%, WAF selects approximately 10% of the IP addresses. WAF then applies the rule to all requests from these selected IP addresses, not to a random 10% of all requests.

   3. In the [有効化されるモード] section, select when the rule takes effect.

      • [Permanently Effective] (Default): The rule is always active when the protection template is enabled.

      • [期間ごとに有効化する]: The protection rule is active only during a specified time period.

      • [周期ごとに有効化する]: The protection rule is active only during a specified recurring schedule.

2. In the [リスク識別] section, you can click [Create] to create a risk identification rule. Based on WAF's built-in phone number reputation database, this feature blocks access from suspicious phone numbers, such as those associated with scalpers. It is suitable for scenarios like phone number-based logon and registration.

   重要

   Risk identification is a paid feature. The billing rules are as follows:

   • Billing Conditions: You are charged only when a request matches a configured rule.

   • Unit Price: USD 0.007/request.

   • Billing Method: Pay-as-you-go. Bills are generated daily.

   • [アカウントの抽出]: Click [アカウントの追加] to configure the [アカウントのタイプ] and [アカウントの位置]. You can add up to five conditions, which are evaluated with a logical OR.

     Example configuration: If a login request uses the GET method and the request parameters are in the format username=158***&password=***, configure the settings as follows:

     • [アカウントの位置]: Select [Query パラメーター].

     • [パラメーター名]: Enter username.

     This configuration allows WAF to accurately extract the phone number from the request for threat detection.

   • [リスクタグ]: Click [タグを追加] to configure tags. You can add up to five tags, which are evaluated with a logical OR.

     • [疑似なりすましアカウント]: The phone number is suspected to be from a third-party platform rather than a personal user.

     • [詐欺リスク]: The phone number is suspected to have a history of fraudulent activity.

     • [虚偽登録]: The phone number is suspected of being used with illicit tools for user registration, often for future marketing campaigns.

     • [マーケティングの不正行為]: The phone number is suspected of being used with illicit tools to exploit marketing promotions, such as bulk registering to receive coupons.

     • [なりすましアカウント]: The phone number is suspected of being used with illicit tools to participate in ticket grabbing or other flash sale events.

     The default [Risk Level] for all tags is High. You can change it to High, Medium-high, or Medium based on your business needs.

   • [処理操作]:

     Parameter	Description
     [モニター]	This action does not block requests that match the rule but only logs them. When testing a rule, you can first use the [モニター] mode to analyze WAF logs and confirm that no false positives occur before changing to a different action.
     [JS 検証] (not supported for app protection)	WAF returns a block of JavaScript validation code to the client. A standard browser automatically executes this code. If the client completes execution successfully, WAF allows all requests from that client for a period of time, 30 minutes by default. Otherwise, the requests are blocked.
     [スライダー]	WAF returns a slider verification page to the client. If the client successfully completes the slider challenge, WAF allows all requests from that client for a period of time, 30 minutes by default. Otherwise, the requests are blocked.
     [厳密なスライダー]	WAF returns a slider verification page to the client. If the client successfully completes the slider challenge, the current request is allowed. Otherwise, the request is blocked. In this mode, the client must complete a slider challenge for every request that matches the rule.
     [ブロック]	Blocks requests that match the rule and returns a block page to the client. 説明 WAF uses a default block page. You can also create a custom block page by using the Custom Response feature.
     [back-to-origin マーカー]	You can define a custom header name and content, including rule type, rule ID, and web UMID. WAF does not process the request directly but instead adds a header to forward the hit information to the origin server. You can integrate this with your backend risk control system for business-side processing.

   • [規則的グレースケール] and [有効化されるモード]: For more information, see the descriptions for canary release and effective mode.

3. In the [ポリシーの設定] section, rules are categorized into [悪意のある BOT], [BOT かもしれない], and [良質ボット] based on Alibaba Cloud's bot signature library. For a specific rule, you can perform the following actions:

   • Enable/Disable: Click the icon in the [ステータス] column to enable or disable the rule.

   • Modify rule: Click [編集] to customize the rule.

   • Change classification: For rules in the [悪意のある BOT] and [BOT かもしれない] categories, you can change the classification in the [BOT タイプ] column if the default does not meet your business requirements.

   重要

   • Risk of false positives: Some of the following rules carry a risk of false positives, and improper configuration may cause legitimate requests to be blocked. Before you enable rules in a production environment, we recommend that you set the [処理操作] to [観察], or use [規則的グレースケール]. We recommend that you first test and fine-tune the rules in a non-production environment based on your business characteristics before you deploy them to production.

   • Statistics for CC-based rules: All CC counting rules (such as [少ない IP のアクセスパス]) trigger an immediate action once the threshold is reached within the configured statistical period. The system does not wait for the statistical period to end. After a statistical object is added to the blacklist, if requests from the object continue to trigger the rule, the system continues to count the requests and refreshes the blacklist timeout period for the object.

   1. Configuration recommendations

      • [異常ブラウザプローブ]

        Rule name	False positive risk
        Developer tools, emulator tools	Low
        Abnormal browser environment	Low
        Automation tools, headless browsers	Low
        Abnormal system environment	Low. May affect some users on the Windows XP operating system.
        Abnormal timestamp	Medium. May block requests submitted from a webpage that has been open for more than 2 hours without being refreshed.
        Abnormal Web SDK version	Low. May affect users with older, manually integrated versions of the Web SDK.

      • [デバイスのなりすまし]

        Rule name	False positive risk
        Device hardware information spoofing, browser attribute spoofing, operating system and environment spoofing	Low
        Collected information spoofing, network and geolocation spoofing	Low. If a Layer 7 proxy, such as CDN or Anti-DDoS, is deployed in front of WAF and the proxy setting is not enabled, inaccurate source IP identification may cause false positives.

      • [クローラークライアント]

        Rule name	False positive risk
        Python tool traffic	Low
        Crawler tool traffic	Low

      • [異常な操作]

        Rule name	False positive risk
        All rules	Medium. May block users with low mouse sensitivity.

      • [スクリプトクライアント]

        Rule name	False positive risk
        All rules	Low. The impact depends on your business. For example, the OkHttp tool traffic rule cannot be enabled in a native app environment. The Dart tool traffic rule cannot be enabled if your service is built with Flutter.

      • [IDC データセンター]

        Rule name	False positive risk
        All rules	Medium. May block legitimate traffic in scenarios such as payment callbacks or access from Alibaba Cloud Workspace. False positives may also occur if a Layer 7 proxy is deployed in front of WAF and not configured to forward the original client IP.

      • [脅威インテリジェンス]

        Rule name	False positive risk
        Forged search engine spiders	Low
        Bot threat intelligence IP library, bot threat intelligence fingerprint library	Medium. In scenarios with shared public egress IP addresses, such as in residential or corporate networks, or if a Layer 7 proxy is deployed in front of WAF and not configured to forward the original client IP, false positives may occur. We recommend setting the action to slider CAPTCHA or JavaScript validation.

      • [AI ベースのインテリジェント保護]

        Rule name	False positive risk
        Abnormal path sequence, abnormal device, malicious group behavior, abnormal resource distribution, time-series anomaly	Medium. In scenarios with shared public egress IP addresses, such as in residential or corporate networks, or if a Layer 7 proxy is deployed in front of WAF and not configured to forward the original client IP, false positives may occur. We recommend setting the action to slider CAPTCHA or JavaScript validation.
        Session anomaly	High. In scenarios with shared public egress IP addresses, such as in residential or corporate networks, or if a Layer 7 proxy is deployed in front of WAF and not configured to forward the original client IP, false positives may occur. We recommend setting the action to slider CAPTCHA or JavaScript validation.

      • [アクセス動作の異常]

        Rule name	False positive risk
        Persistent access without collected information, persistent access without session	Low. Web SDK integration is required. Otherwise, no information is collected.
        Bulk replay of interaction trajectories	Low
        Frequent IP changes for the same session, frequent IP changes for the same device	Low
        Few IP access paths, many IP access paths, frequent changes in client types, frequent UA changes for the same IP	Medium. In scenarios with shared public egress IP addresses, such as in residential or corporate networks, or if a Layer 7 proxy is deployed in front of WAF and not configured to forward the original client IP, false positives may occur. We recommend setting the action to slider CAPTCHA or JavaScript validation.

      • [検索エンジンクローラークライアント]

        Rule name	False positive risk
        All rules	We recommend that you keep the default configuration to allow these requests.

   2. Edit rule actions

      Configuration item	Description
      [JS 検証]	WAF returns a block of JavaScript validation code to the client. A standard browser automatically executes this code. If the client completes execution successfully, WAF allows all requests from that client for a period of time, 30 minutes by default. Otherwise, the requests are blocked.
      [ブロック]	Blocks requests that match the rule and returns a block page to the client. 説明 WAF uses a default block page. You can also create a custom block page by using the Custom Response feature.
      [モニター]	This action does not block requests that match the rule but only logs them. When testing a rule, you can first use the [モニター] mode to analyze WAF logs and confirm that no false positives occur before changing to a different action.
      [スライダー]	WAF returns a slider verification page to the client. If the client successfully completes the slider challenge, WAF allows all requests from that client for a period of time, 30 minutes by default. Otherwise, the requests are blocked.
      [厳密なスライダー]	WAF returns a slider verification page to the client. If the client successfully completes the slider challenge, the current request is allowed. Otherwise, the request is blocked. In this mode, the client must complete a slider challenge for every request that matches the rule.
      [back-to-origin マーカー]	You can define a custom header name and content, including rule type, rule ID, and web UMID. WAF does not process the request directly but instead adds a header to forward the hit information to the origin server. You can integrate this with your backend risk control system for business-side processing.

      説明

      When [JS 検証] or [スライダー] is enabled, WAF sets a cookie named acw_sc__v2 (for JavaScript Validation) or acw_sc__v3 (for Slider CAPTCHA) in the Set-Cookie header of the response. The client includes this identifier in the Cookie header of subsequent requests.

   3. Edit Canary Release and Effective Mode.

ステップ 3: 有効範囲の選択

有効対象 セクションで、テンプレートを適用する保護対象オブジェクトまたは保護対象オブジェクトグループを選択し、 アイコンをクリックしてそれらを 選択済み エリアに移動させ、次に OK をクリックします。

日常の運用保守

• テンプレートの編集

  対象のテンプレートの 操作 列で 編集 をクリックします。Edit パネルでテンプレートを変更します。

• テンプレートの削除

  対象のテンプレートの 操作 列で 削除 をクリックします。削除 ダイアログボックスで、情報を確認し、OK をクリックします。

• テンプレートのコピー

  対象のテンプレートの 操作 列で 複製 をクリックします。複製 ダイアログボックスで、情報を確認し、OK をクリックします。

• テンプレートの有効化または無効化

  新しいテンプレートはデフォルトで有効になっています。テンプレートを有効化または無効化するには、ステータス 列の スイッチをクリックします。

• ルールの表示

  対象のテンプレートの アイコンをクリックして、ルール情報を表示します。ルールを有効化または無効化するには、ルールの ステータス 列の スイッチをクリックします。有効なルールについては、ヒットトレンドを表示できます。ルールアクションタイプが JS 検証、スライダー、または 厳密なスライダー の場合、キャプチャの通過率も表示できます。

よくある質問