Use bot management to protect app services

Procedure

Log on to the Web Application Firewall 3.0 console. In the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) of your Web Application Firewall (WAF) instance. In the left-side navigation pane, choose Protection Config > Bot Management > Bot Management Template. On the App Protection tab, click Create Template.

Step 1: Define protection scenarios

1. Enter a recognizable Template Name and Template Description.

2. Select the Traffic Characteristics. The supported types are Global and Customize Match Conditions.

   • Global: Applies to all traffic for the domain name, including from web pages, apps, and mini programs.

   • Customize Match Conditions: Distinguishes traffic types based on request characteristics. This is useful when web pages and apps share the same API but you only want to protect web or H5 traffic, or when you want to apply targeted protection policies to specific business endpoints, such as flash sale or logon endpoints.

     Global

     If you select Global, you do not need to specify traffic characteristics.

     Customize Match Conditions

     If you select Customize Match Conditions, WAF matches requests based on the characteristics that you define. Click Add Condition to add a condition. Each condition consists of a Match Field, a Logical Operator, and Match Content. The following table provides a configuration example.

     Note

     A request must meet all conditions in a rule (a logical AND) to trigger it. For more information about match fields and logical operators, see Match conditions.

     Match Field	Logical Operator	Match Content	Description
     URI path	Contains	/login.php	Matches if the request path contains /login.php.
     IP	Belongs to	192.1.XX.XX	Matches if the client IP address is 192.1.XX.XX.

3. Select whether to Exclude Static Files. Requests for static files usually do not involve business logic, and their content is not susceptible to injection attacks. Excluding static files can reduce the detection workload and allow WAF to focus on protecting dynamic APIs. We recommend selecting the default static file types. You can also add custom types.

Step 2: Edit template rules

1. In the App Repackaging section, click Create to configure a rule. This feature prevents attackers from decompiling your app, injecting malicious code or ads, re-signing it, and then repackaging it as a pirated version to send requests to your server.

   • In the Valid Package Name and Signature fields, enter the package name and signature that serve as unique identifiers for your app. You can click Add to configure multiple versions. You can add a maximum of five conditions. These conditions are linked by a logical OR.

   • Rule Type: Classify the rule as Malicious Bot or Suspected Bot.

   • Actions:

     Parameter	Description
     Log	This action does not block requests that match the rule but only logs them. When testing a rule, you can first use the Log mode to analyze WAF logs and confirm that no false positives occur before changing to a different action.
     CAPTCHA	WAF returns a slider verification page to the client. If the client successfully completes the slider challenge, WAF allows all requests from that client for a period of time, 30 minutes by default. Otherwise, the requests are blocked.
     Strict CAPTCHA	WAF returns a slider verification page to the client. If the client successfully completes the slider challenge, the current request is allowed. Otherwise, the request is blocked. In this mode, the client must complete a slider challenge for every request that matches the rule.
     Block	Blocks requests that match the rule and returns a block page to the client. Note WAF uses a default block page. You can also create a custom block page by using the Custom Response feature.
     Origin Custom Header	Lets you define a custom header and value (such as the rule type, rule ID, and app UMID). WAF adds this header to the request and forwards it to the origin without taking any other action. This enables integration with a backend risk control system for custom processing.

   • In the Canary Rule section, configure the percentage of requests that are affected by the rule based on different dimensions. After you enable the canary rule, you must also set the Dimension and Canary Release Proportion. Dimension includes IP, Custom Header, Custom Parameter, Custom Cookie, Session, and App UMID.

     Note

     A canary rule takes effect based on the configured Dimension, not by randomly applying the rule to a percentage of all requests. For example, if the Dimension is IP and the Canary Release Proportion is 10%, WAF applies the rule to all requests from a selected 10% of source IP addresses.

   • In the Effective Mode section, select when the rule takes effect.

     • Permanently Effective (Default): The rule is always active when the protection template is enabled.

     • Fixed Schedule: The protection rule is active only during a specified time period.

     • Recurring Schedule: The protection rule is active only during a specified recurring schedule.

2. In the Risk Identification section, you can click Create to create a risk identification rule. Based on WAF's built-in phone number reputation database, this feature blocks access from suspicious phone numbers, such as those associated with scalpers. It is suitable for scenarios like phone number-based logon and registration.

   Important

   Risk identification is a paid feature. The billing rules are as follows:

   • Billing Conditions: You are charged only when a request matches a configured rule.

   • Unit Price: CNY 0.05/request.

   • Billing Method: Pay-as-you-go. Bills are generated daily.

   • Account Extraction: Click Add Account to configure the Account Type and Location. You can add up to five conditions, which are evaluated with a logical OR.

     Example configuration: If a login request uses the GET method and the request parameters are in the format username=158***&password=***, configure the settings as follows:

     • Location: Select Query Parameters.

     • Parameter Name: Enter username.

     This configuration allows WAF to accurately extract the phone number from the request for threat detection.

   • Risk Tag: Click Add Tag to configure tags. You can add up to five tags, which are evaluated with a logical OR.

     • Suspicious Sock Puppet Account: The phone number is suspected to be from a third-party platform rather than a personal user.

     • Fraud Risk: The phone number is suspected to have a history of fraudulent activity.

     • Spam Registration: The phone number is suspected of being used with illicit tools for user registration, often for future marketing campaigns.

     • Marketing Fraud: The phone number is suspected of being used with illicit tools to exploit marketing promotions, such as bulk registering to receive coupons.

     • Ticket-Scalping Bot: The phone number is suspected of being used with illicit tools to participate in ticket grabbing or other flash sale events.

     The default Risk Level for all tags is High. You can change it to High, Medium-high, or Medium based on your business needs.

   • Actions:

     Parameter	Description
     Log	This action does not block requests that match the rule but only logs them. When testing a rule, you can first use the Log mode to analyze WAF logs and confirm that no false positives occur before changing to a different action.
     CAPTCHA	WAF returns a slider verification page to the client. If the client successfully completes the slider challenge, WAF allows all requests from that client for a period of time, 30 minutes by default. Otherwise, the requests are blocked.
     Strict CAPTCHA	WAF returns a slider verification page to the client. If the client successfully completes the slider challenge, the current request is allowed. Otherwise, the request is blocked. In this mode, the client must complete a slider challenge for every request that matches the rule.
     Block	Blocks requests that match the rule and returns a block page to the client. Note WAF uses a default block page. You can also create a custom block page by using the Custom Response feature.
     Origin Custom Header	Lets you define a custom header and value (such as the rule type, rule ID, and app UMID). WAF adds this header to the request and forwards it to the origin without taking any other action. This enables integration with a backend risk control system for custom processing.

   • Canary Rule and Effective Mode: For details, see the descriptions of Canary Rule and Effective Mode in the preceding section.

3. In the Policy Configurations section, rules are categorized into Malicious Bot, Suspected Bot, and Legitimate Bot based on a library of common bot signatures developed from Alibaba Cloud's experience. You can perform the following operations on these rules:

   • Enable/Disable: Click the icon in the Status column to enable or disable the rule.

   • Modify rule: Click Edit to customize the rule.

   • Change classification: For rules in the Malicious Bot and Suspected Bot categories, you can change the classification in the Bot Type column if the default does not meet your business requirements.

   • Edit rule actions

     Parameter	Description
     Log	This action does not block requests that match the rule but only logs them. When testing a rule, you can first use the Log mode to analyze WAF logs and confirm that no false positives occur before changing to a different action.
     CAPTCHA	WAF returns a slider verification page to the client. If the client successfully completes the slider challenge, WAF allows all requests from that client for a period of time, 30 minutes by default. Otherwise, the requests are blocked.
     Strict CAPTCHA	WAF returns a slider verification page to the client. If the client successfully completes the slider challenge, the current request is allowed. Otherwise, the request is blocked. In this mode, the client must complete a slider challenge for every request that matches the rule.
     Block	Blocks requests that match the rule and returns a block page to the client. Note WAF uses a default block page. You can also create a custom block page by using the Custom Response feature.
     Origin Custom Header	Lets you define a custom header and value (such as the rule type, rule ID, and app UMID). WAF adds this header to the request and forwards it to the origin without taking any other action. This enables integration with a backend risk control system for custom processing.

     Note

     When JavaScript Validation or CAPTCHA is enabled, WAF sets a cookie named acw_sc__v2 (for JavaScript Validation) or acw_sc__v3 (for Slider CAPTCHA) in the Set-Cookie header of the response. The client includes this identifier in the Cookie header of subsequent requests.

   • Edit the canary rule and effective mode.

Step 3: Select the scope

In the Apply To section, select the protected objects or protected object groups to which you want to apply the template, click the icon to move them to the Selected area, and then click OK.

Step 4: Integrate the app SDK

The bot protection feature relies heavily on data collected by the SDK. Without SDK integration, WAF cannot provide full protection.

After you integrate the SDK, it automatically collects client risk features, generates a security signature, and attaches it to business requests. WAF then uses this signature to accurately identify and block risky requests.

Based on your mobile operating system, follow the SDK Integration Guide to integrate the app SDK.

Routine O&M

• Edit a template

  Click Edit in the Actions column for the target template. Modify the template in the Edit panel.

• Delete a template

  Click Delete in the Actions column for the target template. In the Delete dialog box, confirm the information and click OK.

• Copy a template

  Click Copy in the Actions column for the target template. In the Copy dialog box, confirm the information and click OK.

• Enable or disable a template

  New templates are enabled by default. You can click the switch in the Status column of the target template to enable or disable it.

• View rules

  Click the icon for the target template to view its rule information. To enable or disable a rule, click the switch in the Status column of the rule. For enabled rules, you can view their hit trend. If the rule action type is JavaScript Validation, CAPTCHA, or Strict CAPTCHA, you can also view the CAPTCHA pass rate.