Intrusion prevention
ApsaraDB RDS protects database instances against both network-layer and application-layer attacks, including DDoS attack mitigation (traffic scrubbing and blackhole filtering) and SQL injection detection.
Connect to RDS instances over an internal network rather than the Internet. This helps prevent DDoS attacks.
DDoS attack mitigation
Volumetric network attacks flood an RDS instance with Internet traffic to exhaust its capacity and deny service to legitimate users. RDS defends against these attacks automatically in two stages:
-
Traffic scrubbing — filters malicious traffic while keeping the instance accessible.
-
Blackhole filtering — applied if scrubbing cannot contain the attack, or if the blackhole triggering threshold is reached. Drops all inbound Internet traffic to protect the underlying infrastructure.
Both stages are triggered and lifted automatically.
Traffic scrubbing
Traffic scrubbing targets only inbound Internet traffic and does not affect internal network connections or normal database operations.
Scrubbing is triggered when any of the following thresholds are reached:
| Metric | Threshold |
|---|---|
| Packets per second (PPS) | 30,000 |
| Bits per second (BPS) | 180 Mbit/s |
| New concurrent connections per second | 10,000 |
| Active concurrent connections | 10,000 |
| Inactive concurrent connections | 100,000 |
Blackhole filtering
Blackhole filtering is a last-resort measure. When triggered, all inbound Internet traffic to the RDS instance is dropped at the network level, making the instance unreachable from the Internet. Applications that connect over the Internet become unavailable until filtering is lifted.
Internal network connections are not affected by blackhole filtering.
Blackhole filtering is triggered when either of the following conditions is met:
-
BPS reaches 2 Gbit/s.
-
Traffic scrubbing cannot contain the attack.
Blackhole filtering is automatically lifted after 2.5 hours.