This topic answers frequently asked questions about the application protection feature in Security Center.
What is the difference between application protection and WAF?
Application Protection RASP (Runtime Application Self-Protection) and Web Application Firewall (WAF) are two different technologies that protect applications. RASP excels at protecting against attacks that target servers, such as zero-day attacks and attacks over encrypted traffic. WAF excels at defending against traffic-based attacks at the front end. The security capabilities of these two technologies are complementary, and we recommend that you configure both Application Protection and WAF.
Item | Application protection (RASP) | WAF |
Focus | Secures the application internally, regardless of the traffic source. | Filters and blocks attacks based on traffic signatures at the network layer. |
Common protection scope | Both provide defense against common web vulnerabilities, such as SQL injection, remote code execution, file inclusion, and webshells. | |
Specialization | Protects against zero-day vulnerabilities, attacks in complex encoded or encrypted traffic, in-memory webshells, non-HTTP protocol threats, and lateral movement within an internal network. | Protects against denial-of-service (DoS) attacks (for example, CC attacks), crawler attacks, and scanners, and provides access control and API security. |
Detection method | Analyzes application behavior to detect attacks. | Matches and filters traffic based on attack signatures. |
Deployment | On the server, integrated directly into the application runtime. | At the border gateway or in-line before the server. Non-intrusive. |
Performance impact | Consumes server resources. | Consumes WAF resources. No performance impact on the application or origin server. |
Remediation | Applies a virtual patch and can pinpoint the exact line of code being exploited. | Applies a virtual patch and reports the signature of the exploit attempt. |
Zero-day vulnerability prevention | Supported by default. | Requires custom rules based on the specific exploit pattern. |
How do I verify that an application is protected?
Log on to the Security Center console.
In the left-side navigation pane, choose . In the upper-left corner of the console, select your asset region: Chinese Mainland or Outside Chinese Mainland.
On the Application Protection page, click the Application Configurations tab. Find the target application group and click the number in the Authorized Process column.
In the instance details panel, view the list of protected applications.
If the process ID (PID) of your application appears in the list, your application is protected.
On the Instance Details page, confirm that the PID of your target server exists in the table and the Status column displays a green Online (Authorized) indicator. This confirms that the application is successfully protected.
Does application protection affect application performance?
Application protection has minimal impact on system performance, compatibility, and stability. In performance tests, enabling application protection resulted in a CPU overhead of less than 1%, less than 50 MB of additional memory usage, and an application latency increase of less than 1 millisecond.
To further ensure stability, application protection includes safeguards such as a soft circuit-breaking mechanism. For more information, see Enable application protection.
How do I choose a protection mode?
Attacks detected by application protection represent real security threats. Unlike traditional traffic-based detection, the false positive rate is extremely low. Therefore, treat all detected attacks seriously. By default, application protection operates in Monitor mode. After you verify that your application runs stably, you can switch to Block mode.
Why is no attack data displayed?
This may occur for two reasons:
The target application is not fully integrated. Enable protection for the application process again. For more information, see Enable application protection.
No real attacks have occurred. Unlike a traditional firewall that alerts on malicious signatures, application protection only reports verified attacks that have a real impact. For example, an attack that exploits a PHP vulnerability is harmless in a Java environment and would not be reported. A verified attack from application protection means an attacker has likely bypassed your perimeter defenses. While you may not see a high volume of these attacks, each one is a critical event that requires immediate attention. Block the attack or patch the underlying vulnerability.
What is the difference between weakness detection and the weak password check in baseline checks?
The weakness detection feature analyzes an application's runtime behavior and memory to identify potential risks. The baseline check feature scans system configurations for security risks, such as CIS benchmarks, classified protection compliance, and static file detection.
Why does application protection fail to enable?
Protection can fail for the following reasons:
If antivirus software is installed on the host, it may quarantine the Security Center agent or the RASP agent. Check your antivirus software to confirm.
On a Linux server, check whether the password for the root account has expired.
How do I determine whether my service is blocked by application protection?
If you find an AliCloudRaspSecurityException runtime exception in your service logs, RASP has detected a potential security threat and blocked the corresponding process. To allow this behavior, add the process to a whitelist. For more information, see Create whitelist rules.