Use bot management to protect web applications

Procedure

Log on to the WAF 3.0 console. In the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) of your WAF instance. In the left-side navigation pane, choose Protection Config > Bot Management > Bot Management Template. On the Web Protection > Protection Template tab, click Create Template.

Step 1: Define the protection scenario

1. Enter a Template Name and Template Description.

2. Select the Traffic Characteristics. You can choose between Global and Customize Match Conditions.

   • Global: Applies to scenarios that involve only web or H5 environments.

   • Customize Match Conditions: Applies to scenarios that involve app or miniapp environments in addition to web or H5 environments, or scenarios where you need to protect specific business endpoints, such as logon or flash sale endpoints.

     Global

     If you select Global, you do not need to define specific match conditions.

     Customize Match Conditions

     WAF matches requests based on the conditions you define. Click Add Condition to add a condition. Each condition consists of a Match Field, a Logical Operator, and the Match Content. The following table provides configuration examples.

     Note

     If a rule has multiple conditions, a request must meet all of them (a logical AND) to hit the rule. For more information about match fields and logical operators, see Match conditions.

     Match Field	Logical Operator	Match Content	Description
     URI Path	Contains	/login.php	Matches if the request path contains /login.php.
     IP	Belongs to	192.1.XX.XX	Matches if the client IP is 192.1.XX.XX.

3. Select whether to Exclude Static Files. Requests for static files usually do not involve business logic, and their content is not susceptible to injection attacks. Excluding static files can reduce the detection workload and allow WAF to focus on protecting dynamic APIs. We recommend selecting the default static file types. You can also add custom types.

Step 2: Edit template rules

1. In the CAPTCHA section, click Edit to configure the CAPTCHA rules.

   1. Select a verification mode. JavaScript Validation and Token-based Authentication are supported.

      • JavaScript Validation: Suitable for low-intensity daily protection scenarios.

      • Token-based Authentication: Suitable for high-intensity adversarial scenarios. We recommend enabling this mode during critical protection periods, such as a few minutes before a major sales promotion.

        JavaScript Validation

        When a rule is triggered, WAF returns a block of JavaScript code. A standard browser client executes the code to obtain a pass token and resends the request. Malicious traffic is blocked because it does not carry the pass token. Once authenticated, the client can make subsequent requests for a set period (30 minutes by default) without further verification.

        Token-based Authentication

        When a rule is triggered, WAF returns a block of JavaScript code. A standard browser client executes the code to sign the request and resend it. WAF blocks malicious requests that lack the required signature. Options include the following:

        • Signature Timestamp Exception: Blocks requests if the signature timestamp is abnormal.

        • WebDriver Attack: Blocks requests if a WebDriver attack is detected.

   2. In the Canary Rule section, you can configure the percentage of traffic that is affected by the rule based on a dimension. After you enable canary release, you must set a Dimension and a Canary Release Proportion. The available options for Dimension are IP, Custom Header, Custom Parameter, Custom Cookie, Session, and Web UMID.

      Note

      A canary release takes effect based on the configured Dimension, not by randomly applying the rule to a percentage of requests. For example, if the Dimension is IP and the Canary Release Proportion is 10%, WAF selects approximately 10% of the IP addresses. WAF then applies the rule to all requests from these selected IP addresses, not to a random 10% of all requests.

   3. In the Effective Mode section, select when the rule takes effect.

      • Permanently Effective (Default): The rule is always active when the protection template is enabled.

      • Fixed Schedule: The protection rule is active only during a specified time period.

      • Recurring Schedule: The protection rule is active only during a specified recurring schedule.

2. In the Risk Identification section, you can click Create to create a risk identification rule. Based on WAF's built-in phone number reputation database, this feature blocks access from suspicious phone numbers, such as those associated with scalpers. It is suitable for scenarios like phone number-based logon and registration.

   Important

   Risk identification is a paid feature. The billing rules are as follows:

   • Billing Conditions: You are charged only when a request matches a configured rule.

   • Unit Price: CNY 0.05/request.

   • Billing Method: Pay-as-you-go. Bills are generated daily.

   • Account Extraction: Click Add Account to configure the Account Type and Location. You can add up to five conditions, which are evaluated with a logical OR.

     Example configuration: If a login request uses the GET method and the request parameters are in the format username=158***&password=***, configure the settings as follows:

     • Location: Select Query Parameters.

     • Parameter Name: Enter username.

     This configuration allows WAF to accurately extract the phone number from the request for threat detection.

   • Risk Tag: Click Add Tag to configure tags. You can add up to five tags, which are evaluated with a logical OR.

     • Suspicious Sock Puppet Account: The phone number is suspected to be from a third-party platform rather than a personal user.

     • Fraud Risk: The phone number is suspected to have a history of fraudulent activity.

     • Spam Registration: The phone number is suspected of being used with illicit tools for user registration, often for future marketing campaigns.

     • Marketing Fraud: The phone number is suspected of being used with illicit tools to exploit marketing promotions, such as bulk registering to receive coupons.

     • Ticket-Scalping Bot: The phone number is suspected of being used with illicit tools to participate in ticket grabbing or other flash sale events.

     The default Risk Level for all tags is High. You can change it to High, Medium-high, or Medium based on your business needs.

   • Actions:

     Parameter	Description
     Log	This action does not block requests that match the rule but only logs them. When testing a rule, you can first use the Log mode to analyze WAF logs and confirm that no false positives occur before changing to a different action.
     JavaScript Validation (not supported for app protection)	WAF returns a block of JavaScript validation code to the client. A standard browser automatically executes this code. If the client completes execution successfully, WAF allows all requests from that client for a period of time, 30 minutes by default. Otherwise, the requests are blocked.
     CAPTCHA	WAF returns a slider verification page to the client. If the client successfully completes the slider challenge, WAF allows all requests from that client for a period of time, 30 minutes by default. Otherwise, the requests are blocked.
     Strict CAPTCHA	WAF returns a slider verification page to the client. If the client successfully completes the slider challenge, the current request is allowed. Otherwise, the request is blocked. In this mode, the client must complete a slider challenge for every request that matches the rule.
     Block	Blocks requests that match the rule and returns a block page to the client. Note WAF uses a default block page. You can also create a custom block page by using the Custom Response feature.
     Origin Custom Header	You can define a custom header name and content, including rule type, rule ID, and web UMID. WAF does not process the request directly but instead adds a header to forward the hit information to the origin server. You can integrate this with your backend risk control system for business-side processing.

   • Canary Rule and Effective Mode: For more information, see the descriptions for canary release and effective mode.

3. In the Policy Configurations section, rules are categorized into Malicious Bot, Suspected Bot, and Legitimate Bot based on Alibaba Cloud's bot signature library. For a specific rule, you can perform the following actions:

   • Enable/Disable: Click the icon in the Status column to enable or disable the rule.

   • Modify rule: Click Edit to customize the rule.

   • Change classification: For rules in the Malicious Bot and Suspected Bot categories, you can change the classification in the Bot Type column if the default does not meet your business requirements.

   Important

   • Risk of false positives: Some of the following rules carry a risk of false positives, and improper configuration may cause legitimate requests to be blocked. Before you enable rules in a production environment, we recommend that you set the Actions to Monitor, or use Canary Rule. We recommend that you first test and fine-tune the rules in a non-production environment based on your business characteristics before you deploy them to production.

   • Statistics for CC-based rules: All CC counting rules (such as Few Access Paths from IP Address) trigger an immediate action once the threshold is reached within the configured statistical period. The system does not wait for the statistical period to end. After a statistical object is added to the blacklist, if requests from the object continue to trigger the rule, the system continues to count the requests and refreshes the blacklist timeout period for the object.

   1. Configuration recommendations

      • Abnormal Browser Probe

        Rule name	False positive risk
        Developer tools, emulator tools	Low
        Abnormal browser environment	Low
        Automation tools, headless browsers	Low
        Abnormal system environment	Low. May affect some users on the Windows XP operating system.
        Abnormal timestamp	Medium. May block requests submitted from a webpage that has been open for more than 2 hours without being refreshed.
        Abnormal Web SDK version	Low. May affect users with older, manually integrated versions of the Web SDK.

      • Device Spoofing

        Rule name	False positive risk
        Device hardware information spoofing, browser attribute spoofing, operating system and environment spoofing	Low
        Collected information spoofing, network and geolocation spoofing	Low. If a Layer 7 proxy, such as CDN or Anti-DDoS, is deployed in front of WAF and the proxy setting is not enabled, inaccurate source IP identification may cause false positives.

      • Crawler Client

        Rule name	False positive risk
        Python tool traffic	Low
        Crawler tool traffic	Low

      • Abnormal Behavior

        Rule name	False positive risk
        All rules	Medium. May block users with low mouse sensitivity.

      • Script Client

        Rule name	False positive risk
        All rules	Low. The impact depends on your business. For example, the OkHttp tool traffic rule cannot be enabled in a native app environment. The Dart tool traffic rule cannot be enabled if your service is built with Flutter.

      • IDC

        Rule name	False positive risk
        All rules	Medium. May block legitimate traffic in scenarios such as payment callbacks or access from Alibaba Cloud Workspace. False positives may also occur if a Layer 7 proxy is deployed in front of WAF and not configured to forward the original client IP.

      • Threat Intelligence

        Rule name	False positive risk
        Forged search engine spiders	Low
        Bot threat intelligence IP library, bot threat intelligence fingerprint library	Medium. In scenarios with shared public egress IP addresses, such as in residential or corporate networks, or if a Layer 7 proxy is deployed in front of WAF and not configured to forward the original client IP, false positives may occur. We recommend setting the action to slider CAPTCHA or JavaScript validation.

      • AI-Powered Protection

        Rule name	False positive risk
        Abnormal path sequence, abnormal device, malicious group behavior, abnormal resource distribution, time-series anomaly	Medium. In scenarios with shared public egress IP addresses, such as in residential or corporate networks, or if a Layer 7 proxy is deployed in front of WAF and not configured to forward the original client IP, false positives may occur. We recommend setting the action to slider CAPTCHA or JavaScript validation.
        Session anomaly	High. In scenarios with shared public egress IP addresses, such as in residential or corporate networks, or if a Layer 7 proxy is deployed in front of WAF and not configured to forward the original client IP, false positives may occur. We recommend setting the action to slider CAPTCHA or JavaScript validation.

      • Abnormal Access Behavior

        Rule name	False positive risk
        Persistent access without collected information, persistent access without session	Low. Web SDK integration is required. Otherwise, no information is collected.
        Bulk replay of interaction trajectories	Low
        Frequent IP changes for the same session, frequent IP changes for the same device	Low
        Few IP access paths, many IP access paths, frequent changes in client types, frequent UA changes for the same IP	Medium. In scenarios with shared public egress IP addresses, such as in residential or corporate networks, or if a Layer 7 proxy is deployed in front of WAF and not configured to forward the original client IP, false positives may occur. We recommend setting the action to slider CAPTCHA or JavaScript validation.

      • Search Engine Crawler Client

        Rule name	False positive risk
        All rules	We recommend that you keep the default configuration to allow these requests.

   2. Edit rule actions

      Configuration item	Description
      JavaScript Validation	WAF returns a block of JavaScript validation code to the client. A standard browser automatically executes this code. If the client completes execution successfully, WAF allows all requests from that client for a period of time, 30 minutes by default. Otherwise, the requests are blocked.
      Block	Blocks requests that match the rule and returns a block page to the client. Note WAF uses a default block page. You can also create a custom block page by using the Custom Response feature.
      Log	This action does not block requests that match the rule but only logs them. When testing a rule, you can first use the Log mode to analyze WAF logs and confirm that no false positives occur before changing to a different action.
      CAPTCHA	WAF returns a slider verification page to the client. If the client successfully completes the slider challenge, WAF allows all requests from that client for a period of time, 30 minutes by default. Otherwise, the requests are blocked.
      Strict CAPTCHA	WAF returns a slider verification page to the client. If the client successfully completes the slider challenge, the current request is allowed. Otherwise, the request is blocked. In this mode, the client must complete a slider challenge for every request that matches the rule.
      Origin Custom Header	You can define a custom header name and content, including rule type, rule ID, and web UMID. WAF does not process the request directly but instead adds a header to forward the hit information to the origin server. You can integrate this with your backend risk control system for business-side processing.

      Note

      When JavaScript Validation or CAPTCHA is enabled, WAF sets a cookie named acw_sc__v2 (for JavaScript Validation) or acw_sc__v3 (for Slider CAPTCHA) in the Set-Cookie header of the response. The client includes this identifier in the Cookie header of subsequent requests.

   3. Edit Canary Release and Effective Mode.

Step 3: Select the effective scope

In the Apply To section, select the protected objects or protected object groups to which you want to apply the template, click the icon to move them to the Selected area, and then click OK.

Routine O&M

• Edit a template

  Click Edit in the Actions column for the target template. Modify the template in the Edit panel.

• Delete a template

  Click Delete in the Actions column for the target template. In the Delete dialog box, confirm the information and click OK.

• Copy a template

  Click Copy in the Actions column for the target template. In the Copy dialog box, confirm the information and click OK.

• Enable or disable a template

  New templates are enabled by default. You can click the switch in the Status column of the target template to enable or disable it.

• View rules

  Click the icon for the target template to view its rule information. To enable or disable a rule, click the switch in the Status column of the rule. For enabled rules, you can view their hit trend. If the rule action type is JavaScript Validation, CAPTCHA, or Strict CAPTCHA, you can also view the CAPTCHA pass rate.