Application Scenario

Reading time: About 4 minutes

Different threats call for different protection capabilities. This topic lists typical application scenarios for Flood Shield 2.0, helping you determine which category your business falls into, which capabilities to enable, and how protection takes effect in each scenario.

Scenario Overview

Large-Scale L3/L4 DDoS Attack Mitigation

Scenario characteristics: Your business is hit by high-volume attacks at the network and transport layers, such as SYN Flood, UDP Flood, and various reflection amplification attacks. These attacks aim to consume bandwidth and connection resources; once bandwidth is saturated, legitimate users can no longer establish connections.

Capabilities enabled:

• Always-on traffic routing: Business traffic flows through scrubbing centers by default, so no temporary route switching is needed when an attack occurs.
• Protocol validation and anomaly filtering: Traffic is validated against protocol characteristics to filter out spoofed sources and malformed packets.
• Adaptive rate limiting and connection control: Rate limiting policies adjust to real-time traffic behavior, so legitimate traffic is not throttled along with attack traffic.

Outcome: Attacks are scrubbed before they reach the origin server, leaving origin bandwidth and connection resources unaffected.

L7 Attack and Automated Bot Traffic Protection

Scenario characteristics: Attackers target the application layer directly through HTTP/HTTPS requests, for example HTTP Flood, API abuse, credential stuffing, and automated bot scraping. These requests look much like legitimate traffic, so network-layer protection alone cannot identify them.

Capabilities enabled:

• WAF Protection: Detects and blocks application-layer attack requests such as SQL injection and XSS.
• Bot Management: Identifies automated bot traffic and blocks or challenges behavior such as scraping and credential stuffing.
• API Security: Analyzes API request behavior and applies access control to abnormal calls.
• L7 DDoS protection: Mitigates slow responses or service unavailability caused by high-frequency concurrent requests.

Outcome: Legitimate users see no change in their experience, while application-layer attack requests are accurately identified and blocked.

Multi-Vector Attack Protection (Combined L3–L7 Attacks)

Scenario characteristics: Attackers often combine high-volume attacks with application-layer attacks to amplify the impact and bypass protection at a single layer. With only one layer protected, you may encounter a situation where network-layer traffic looks normal while the application layer is already saturated.

Capabilities enabled:

• Unified analysis: Attack behavior at L3, L4, and L7 is correlated to identify the multiple vectors of a single attack event.
• Coordinated policies: Policies for every layer are configured in the same console and their protection actions are enforced together, so you do not maintain them separately.
• Behavior correlation: Cross-layer traffic correlation identifies multi-vector attack behavior.

Use when: Your business system faces constantly changing attack methods, or combined attacks have already occurred.

TCP/UDP Application Protection

Scenario characteristics: Online gaming, real-time communication, and custom-protocol services run over TCP/UDP and do not use HTTP/HTTPS, so web security solutions cannot cover them.

Capabilities enabled:

• L3/L4 DDoS protection: Provides TCP/UDP services with the same network-layer protection as HTTP services.
• Connection stability: Keeps established business connections alive during an attack, preventing game disconnections or dropped calls.
• Protocol signature identification: Filters abnormal traffic by business protocol characteristics and forwards only legitimate traffic to the origin server.

Outcome: Web and non-web services are onboarded and protected on the same platform, with no need to maintain two separate solutions.

Burst Traffic and Business Peak Protection

Scenario characteristics: Promotions, live streaming, and product launches drive traffic far above daily levels. The curve of burst traffic resembles that of attack requests, so a policy that judges by fixed thresholds may falsely block a legitimate business peak.

Capabilities enabled:

• Traffic baseline modeling: Builds a baseline from historical access behavior to distinguish regular growth from anomalies that have never occurred before.
• Dynamic threshold adjustment: Adjusts protection thresholds to real-time traffic, relaxing automatically as business grows and tightening quickly when an attack occurs.
• Elastic resource scaling: Scales bandwidth and scrubbing resources on demand, carrying burst traffic without degrading access quality.

Outcome: Access stays stable during business peaks, and legitimate users are not affected by protection policies.

Why does burst traffic not get confused with attack requests?
The deciding factor is whether the traffic matches the existing baseline: traffic that follows historical patterns is allowed as legitimate business, while traffic that clearly deviates from the baseline is treated as an attack. Newly onboarded businesses lack historical data, so run in Monitor Mode for 3–7 days to build the baseline first, and switch to Protection Mode once you have confirmed there are no false positives.

Next Steps

• → Onboard Website Protection — Onboard L7 protection and DDoS protection for HTTP/HTTPS services
• → Onboard Non-Website Protection — Onboard L3/L4 protection for TCP/UDP services such as gaming and real-time communication
• → About Flood Shield 2.0 — Learn about the product architecture and overall protection capabilities