DDoS protection, CDN, Anycast и rate limiting
Многослойна защита за availability.
Какво е
Многослойна защита за availability.
Как работи
Volumetric traffic се абсорбира upstream/CDN/scrubbing layer; Layer 7 requests се управляват чрез rate limits, bot mitigation и caching.
Защо няма една „DDoS защита“
Volumetric flood, SYN/state exhaustion и application-layer expensive requests натоварват различни ресурси.
Пример
HTTP endpoint /generate-report прави 15 секунди CPU работа. 500 добре подбрани заявки могат да бъдат по-опасни от милиони cached GET requests. CDN сам по себе си не поправя expensive business logic.
Добър layered модел
Anycast/CDN → scrubbing → connection controls → WAF/bot controls → per-user/API quotas → application circuit breakers
Как да проверим
Провеждайте controlled load/resilience tests и измервайте не само availability, а latency, queue depth, autoscaling behavior и cloud cost.
Практическа имплементация
- CDN/Anycast.
- Origin shielding.
- Per-IP/user/token quotas.
- Concurrency limits.
- Circuit breakers.
- Autoscaling с spend guardrails.
Какво НЕ решава
Cost-exhaustion и application-specific expensive operations изискват business-level limits.
Предпазва най-силно от
- API Scraping · API и business-logic атаки
- Application-Layer (Layer 7) DDoS · DoS и DDoS
- Denial-of-Service (DoS) · DoS и DDoS
- Distributed Denial-of-Service (DDoS) · DoS и DDoS
- DNS Amplification · DoS и DDoS
- DNS Query/NXDOMAIN Flood · DoS и DDoS
- Email Bombing / Subscription Bombing · DoS и DDoS
- GraphQL Query Abuse · API и business-logic атаки
- HTTP Flood · DoS и DDoS
- ICMP/Ping Flood · DoS и DDoS
- Memcached Amplification · DoS и DDoS
- NTP Amplification · DoS и DDoS
- Ping of Death / Malformed-Packet DoS · DoS и DDoS
- Protocol/State-Exhaustion DDoS · DoS и DDoS
- Ransom DDoS (RDDoS) · DoS и DDoS
- Reflection/Amplification DDoS · DoS и DDoS
- Slowloris / Low-and-Slow Attack · DoS и DDoS
- Smurf Attack · DoS и DDoS
- SSDP/UPnP Amplification · DoS и DDoS
- SYN Flood · DoS и DDoS
- UDP Flood · DoS и DDoS
- Unbounded Consumption / Model DoS · AI, ML и LLM атаки
- Unrestricted Resource Consumption · API и business-logic атаки
- Volumetric DDoS · DoS и DDoS