Anti-DDoS and WAF Selection

Overview

Huawei Cloud provides multiple anti-DDoS solutions to defend against DDoS attacks. You can select a proper solution as required.
- Cloud Native Anti-DDoS Basic (CNAD Basic) provides free protection for Huawei Cloud elastic IP addresses (EIPs) against network-layer DDoS attacks, including flood attacks and resource exhaustion attacks. It also provides real-time attack alarms and interception capabilities to improve bandwidth utilization and ensure service stability and reliability.
- Cloud Native Anti-DDoS (CNAD), a security service developed by Huawei Cloud, directly improves the anti-DDoS capabilities for cloud services such as Elastic Cloud Server (ECS), Elastic Load Balance (ELB), Web Application Firewall (WAF), and EIP. Targeting Huawei Cloud EIPs, CNAD can directly load security capabilities to cloud services with simple configurations. This improves security protection capabilities of cloud services and ensures service security and reliability.
- Advanced Anti-DDoS, the key to ensure service continuity for enterprises, defends the services against heavy-traffic DDoS attacks. It uses high-defense IP addresses to provide services for external systems and divert malicious attacks to high-defense IP addresses for cleaning, ensuring that important services are not interrupted. It can be used to protect hosts of Huawei Cloud, non-Huawei Cloud, and IDC.
WAF is a tool used to protect web applications. It is deployed in front of web applications. WAF checks HTTP and HTTPS traffic between the Internet and web applications and identifies and blocks web attacks based on predefined protection rules. WAF can defend against many types of attacks, such as SQL injection, cross-site scripting (XSS), web shells, command/code injection, file inclusion, sensitive file access, third-party application vulnerability exploits, CC attacks, malicious crawler scanning, and cross-site request forgery (CSRF). You can use WAF to protect web servers, web applications, and sensitive data.

Although Anti-DDoS can defend against heavy-traffic attacks and ensure high service availability, if your services mainly depend on web applications and face web security threats such as SQL injection, XSS attacks, and CC attacks, you can use WAF to ensure the security and stability of your applications. In certain occasions, you can use both of them for multiple-layer defense and comprehensive security protection.

Comparison Between Anti-DDoS and WAF

The following table compares Advanced Anti-DDoS and WAF in terms of main purposes and protection layers.

**Table 1** Core differences
Item	Anti-DDoS	WAF
Purpose	Defend against L3/L4 heavy-traffic DDoS attacks and L7 CC attacks.	Protect against web vulnerabilities (SQLi/XSS/CC/crawler).
Protection layer	Network/transport layer (L3/L4) and application layer (L7) for Advanced Anti-DDoS only	Application layer (L7)

Purpose
- Advanced Anti-DDoS: Aims to protect your network and applications from heavy-traffic attacks. These attacks usually overload your server with a large amount of malicious traffic so that normal users cannot access services.
- WAF: Aims to protect your web applications from application-layer attacks, such as SQL injection, XSS, and CSRF. These attacks usually target vulnerabilities in web applications and attempt to steal data or disrupt application functions.

Protection layer

Advanced Anti-DDoS: Provides protection at the network layer (Layer 3) and transport layer (Layer 4) to defend against heavy-traffic attacks, and at the application layer (Layer 7) to defend against CC attacks.
- Network-layer protection defends against attacks on IP addresses, such as ICMP flood and UDP flood attacks.
- Transport-layer protection defends against attacks on ports, such as TCP SYN flood and TCP RST flood attacks.
WAF: Provides protection at the application layer (Layer 7) to defend against attacks on web applications.

The following table lists the comparison between Advanced Anti-DDoS and WAF application layer protection.

**Table 2** Comparison between Advanced Anti-DDoS and WAF application layer protection
Item	Advanced Anti-DDoS	WAF
Core positioning	Focus on heavy-traffic application layer: In addition to L3/L4 protection, lightweight L7 identification is provided to defend against ultra-large traffic CC/HTTP flood attacks.	In-depth web application protection: Focuses on HTTP/HTTPS content parsing to prevent application-layer intrusions and vulnerability exploits.
Protection principle	Analyzes only the traffic volume, request frequency, and IP connection behavior. In-depth parsing is not performed on the request content. Abnormal access is identified based on the traffic threshold and connection baseline.	Fully parses request headers, URLs, parameters, request bodies, and cookies, and identifies malicious payloads through feature matching, regular expressions, semantic analysis, and behavior detection.
Typical attack scenarios	High-concurrency, ultra-large-traffic services such as gaming, live broadcast, e-commerce promotion, and government and enterprise portal CC, HTTP flood, and slow attacks with over 100,000 QPS L3/L4 DDoS + application-layer CC hybrid attack scenarios HA scenarios where bandwidth should be preferentially guaranteed and services are not interrupted	Standard web services such as websites, mini programs, APIs, and management backends Vulnerability exploits, web page tampering, malicious crawlers, and API traffic spoofing Medium- and low-level QPS services, requiring security compliance and intrusion prevention Scenarios requiring refined access permission control and content risk control
Best combination	Use Advanced Anti-DDoS to defend against heavy traffic, and use WAF to implement precise application protection, forming in-depth defense with Advanced Anti-DDoS (L3/L4 + light L7), WAF (in-depth L7), and origin server.

Function Comparison

**Table 3** Function comparison
Function	Advanced Anti-DDoS	WAF
Core strategy	Identify traffic and clean abnormal traffic to ensure smooth network connection and intercept heavy-traffic attacks.	Parse content and match rules to accurately intercept malicious requests and prevent application-layer intrusions.
Default basic policy	Built-in general-purpose DDoS cleaning policies automatically take effect globally without manual configuration.	Built-in standard web protection policies targeting common vulnerabilities, weak passwords, and malicious requests can be enabled with one click.
Traffic threshold policy	You can define custom inbound/outbound traffic thresholds and the threshold of the number of connections for a single IP address. If the threshold is exceeded, traffic cleaning is automatically triggered.	You can set thresholds for the request and access frequency of a single IP address to defend against CC attacks and high-frequency crawlers.
Blacklist/whitelist policy	You can set blacklists and whitelists to allow or block IP addresses.	You can set blacklists and whitelists by IP address, URL, Referer, and UA.
Region blocking policy	You can block IP address segments by region to intercept abnormal traffic from outside the region.	You can block access from specific regions based on geographical locations.
Protocol management policy	Filter abnormal packets and manage ports for network protocols such as TCP, UDP, and ICMP.	Manage request methods, ports, protocol headers, and cookies for HTTP/HTTPS.
Custom rule	L3/L4 custom rules: Configure interception/rate limiting policies based on packet header information such as the IP address, protocol, port, and traffic connection to block heavy traffic and port DDoS attacks at Layer 4. L7 custom rules: Configure management policies based on HTTP content such as URLs, request headers, cookies, and access frequency to block CC attacks, malicious crawlers, and abnormal web access at Layer 7.	You can compile regular expressions, semantic rules, and combination logic rules to flexibly adapt to personalized protection scenarios.
Rule update mechanism	The cleaning algorithm and policy are automatically iterated by the platform background. You do not have an operation entry.	The threat intelligence and vulnerability rule library are automatically updated periodically. You can also manually enable or disable specified rule groups.
Protection mode switching	Supports switching between common protection, powerful cleaning, and traffic diversion and retrieval.	Supports protection, observation, and record-only modes to facilitate policy trial run and optimization.
Policy log	Records traffic cleaning records, attack types, blocked IP addresses, and traffic data.	Completely records each blocked request, triggering rule, and request details for source tracing and analysis.

Usage

Anti-DDoS

What is Anti-DDoS?
For details about DDoS attacks and Anti-DDoS, see Product Introduction.
How to use Anti-DDoS?
Huawei Cloud Anti-DDoS comprehensively cleans traffic and defends against attacks, ensuring stable services even under heavy-traffic attacks. For details about how to use Anti-DDoS, see Getting Started.
Best Practices
For details about typical Anti-DDoS applications, detailed solutions and operation guides about each practice, and how to use Anti-DDoS, see Best Practices.

WAF

What is WAF?
For details about WAF and its usage and advantages, see Product Introduction.
How to use WAF?
Huawei Cloud WAF comprehensively protects web applications against typical attacks, such as SQL injection, XSS, and CSRF. For details about how to use WAF, see Getting Started.
Best Practices
For details about typical WAF applications, detailed solutions and operation guides about each practice, and how to use WAF, see Best Practices.

Suggestions

When to use Anti-DDoS?
- Your services are exposed to the Internet and face L3/L4 DDoS threats, such as SYN flood, UDP flood, and heavy-traffic amplification attacks.
- 24/7 automatic protection is required to defend against underlying heavy traffic without complex configurations.
- Your services have high requirements on availability, and an expert team is required to handle large-scale DDoS attacks.
When to use WAF?
- Your services face application-layer threats, such as SQL injection, XSS, CC attacks, malicious crawlers, and API abuse.
- Refined traffic control (IP address blocking, rate limiting, URL filtering, and verification code) is required.
- Your services are deployed on Huawei Cloud ECS, ELB, CDN, and API Gateway, and application-layer security protection is required.
See best practices at Using WAF and AAD to Protect Domain Names.
Huawei Cloud WAF detects HTTP and HTTPS requests to identify and block attacks such as SQL injection, XSS, webshell upload, command/code injection, file inclusion, sensitive file access, third-party vulnerability exploits, CC attacks, malicious crawler scanning, and cross-site request forgery, ensuring web service security and stability.

Advanced Anti-DDoS ensures the continuity of domain names and protects your services against heavy-traffic DDoS attacks.

WAF and Advanced Anti-DDoS together can defend against web application attacks and traffic attacks, greatly enhancing the security and stability of domain names.

Next topic: Data Encryption Service Selection