About DDoS Protection

Reading time: About 5 minutes

A Distributed Denial-of-Service (DDoS) attack is a malicious act in which an attacker controls a botnet, compromised proxy devices, or similar resources to flood a target website or server with a massive volume of requests or data, causing the site to load slowly for legitimate users or become completely unreachable.

Leveraging the platform’s CDN resources together with big-data analysis, the platform uses in-house-developed protection algorithms to detect and scrub all types of DDoS attack traffic in real time, covering both network-layer and application-layer DDoS protection. This keeps your website stable and online even during large-scale DDoS attacks.

Network-Layer DDoS Protection

By default, the platform automatically detects and mitigates OSI Layer 3/4 DDoS attacks, including SYN Flood, ACK Flood, ICMP Flood, UDP Flood, and various reflection attacks (such as NTP reflection, Memcache reflection, and SSDP reflection).

Application-Layer DDoS Protection

The application-layer DDoS protection service is built on an intelligent protection engine that combines two mechanisms — managed rule protection and AI-powered protection — to automatically detect attacks and dynamically adjust protection strategies, keeping your business available and stable when it is hit by a DDoS attack at the application layer (e.g., HTTP/HTTPS). The overall protection mechanism is described in detail below.

Dual-Mechanism Collaborative Protection

1. Managed Rule Protection
The platform’s built-in protection rule set is developed from a massive attack-signature database and the accumulated attack-and-defense experience of the security expert team. It comes preconfigured with rules covering common application-layer attacks, such as abnormal request parameters, protocol-specification violations, and suspicious high-frequency requests. This rule set is deployed across globally distributed edge nodes to support sub-second, precise attack matching and blocking.

2. AI-Powered Protection

• Automated attack detection: Powered by the security big-data platform, machine learning models continuously analyze each hostname’s business request baseline, monitoring metrics such as traffic characteristics, request distribution, and origin response status in real time to determine the attack type, attack intensity, and origin status.

• Adaptive protection strategy: Based on the selected protection level and the detected attack status, the system automatically switches protection modes:
  When a hostname is hit by an L7 DDoS attack, the system first adaptively enables managed rules to block the attack.
  If managed rules do not fully block the attack and origin availability is still at risk, the system combines this with its in-house-developed algorithms to automatically identify abnormal attack requests and generate protection rules — applying dynamic blocking, human verification, rate limiting, and other multi-dimensional handling actions to effectively mitigate new types of application-layer DDoS attacks and protect the origin.

Overall Protection Logic

1. Hostname Onboarding and Baseline Learning
When a new hostname is onboarded, the engine automatically applies preset thresholds based on the selected protection level, ensuring the business is protected right from the start. At the same time, the engine learns the hostname’s traffic patterns over a 2–6 hour period to generate business-specific protection thresholds and AI protection rules, which are then dynamically updated every hour to enable precise attack detection and adaptive protection.

2. First Line of Defense — Edge Protection Activation, Fast Blocking
When a hostname is hit by a small-scale L7 DDoS attack, the “Enable During Attack” managed rules deployed on the affected edge node take effect immediately, blocking and handling the attack within seconds.

3. Second Line of Defense — Hostname-Wide Protection Activation, Large-Scale Scrubbing
If the system detects that attack traffic continues to increase, it pushes the “Enable During Attack” managed rules hostname-wide, across all edge nodes serving the hostname, to scrub attack requests globally.

4. Third Line of Defense — AI Protection Rule Generation, Origin Protection
If the system detects that some attack traffic is still getting through and origin availability remains at risk, AI-powered protection steps in with additional protection: based on the specific attack characteristics it has learned, it pinpoints the attack and pushes the corresponding AI protection rules. The AI rule types currently supported are:

• Rate Limiting rules: Protect against high-frequency request attacks
• Empty Request Header rules: Protect against attacks with abnormally empty request headers
• Specific UA rules: Protect against attacks with an abnormal concentration of a specific User-Agent
• JA4 rules: Protect against attacks with an abnormal concentration of a specific JA4 fingerprint

5. Attack Ends
When the system detects that a hostname’s traffic no longer meets the attack-detection criteria for 20 consecutive minutes, the attack on that hostname is considered ended. At this point, the “Enable During Attack” rules are disabled, and all AI rules that were pushed are removed.