DDoS protection solutions-Alibaba Gov Cloud-阿里云帮助中心

To defend against distributed Denial of Service (DDoS) attacks, Alibaba Gov Cloud deploys a DDoS detection system at its public network ingress. This system automatically detects attack behavior and defends against it by redirecting, scrubbing, and reinjecting the traffic.

A DDoS attack is a malicious network attack that targets a system. DDoS attacks often make the victim's services inaccessible, which is known as a denial of service. To defend against these attacks, you must do more than build comprehensive protection into your architecture. You also need to implement business monitoring and establish an emergency response plan, which includes predicting potential threats. This preparation helps you purchase suitable security solutions in advance. DDoS解决方案

Solution details

Although Alibaba Gov Cloud provides security measures, you can build a more robust security system by combining various Alibaba Cloud products and features:

Configure security groups: Avoid exposing non-essential service ports to the public network to prevent unauthorized requests and access. Configuring security groups also helps prevent system scans and accidental exposure.
Use a virtual private cloud (VPC): Create a logically isolated network using a VPC. This helps prevent attacks from zombie servers within your private network.
Optimize DNS resolution: Use smart resolution features to mitigate the threat of DNS flood attacks.

You can use security products such as Server Guard and Web Application Firewall (WAF). Combine these products with server security hardening to improve server performance, such as the number of connections it can handle. You should also harden the operating systems and software services on your servers. This reduces potential attack vectors and increases the cost for attackers.

Solution advantages

Cost-effective: You can defend against most DDoS attacks without purchasing a full suite of security products. This approach allows for elastic upgrades if attacks escalate.
Comprehensive system: This solution considers the unique needs of your business, not just the cloud platform. It avoids a rigid, one-size-fits-all approach that can disrupt business operations and instead provides fine-grained security control through methods such as whitelists, blacklists, VPC isolation, and account isolation.
Easy O&M: O&M engineers do not need to constantly monitor the cluster. They can rely on alerts from services such as Cloud Monitor to maintain efficient operations. You can also configure emergency response plans, such as elastic resource scale-out and dynamic increases in DDoS protection, to handle urgent situations.
Reliable: Alibaba Cloud's data center resources help defend against massive DDoS attacks. The Alibaba Cloud infrastructure is built to handle large-scale attacks.

For customers of Alibaba Gov Cloud data centers, Alibaba Cloud coordinates resources to provide protection against attack traffic of up to 300 Gbps.