Configuring Intelligent Access Control Rules to Accurately Defend Against CC Attacks

Prerequisites

• You have added the website you want to protect to WAF or added a protection policy.
  • For cloud CNAME access mode, see Connecting a Website to WAF (Cloud Mode - CNAME Access).
  • For cloud load balancer access mode, see Connecting Your Website to WAF (Cloud Mode - Load Balancer Access).
  • For dedicated mode, see Connecting Your Website to WAF (Dedicated Mode).
• If you use a dedicated WAF instance, ensure that it has been upgraded to the latest version. For details, see Managing Dedicated WAF Engines.

Constraints

• In cloud mode, intelligent access control rules are supported by professional and platinum editions only.
• Intelligent access control protection is available in North China regions only.
• The intelligent access control rules have the lowest priority.
• When you add a website through Cloud Mode - Load balancer and set Frontend Protocol of the listener of your ELB load balancer to TCP, UDP, or QUIC, this type of rule does not take effect.
• Disabling CC Attack Protection Rule in intelligent access control will delete all CC attack protection rules generated intelligently.
• Disabling Precise Protection Rule in intelligent access control will delete all precise protection rule generated intelligently.

Configuring Intelligent Access Control

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner and choose Web Application Firewall under Security & Compliance.
4. In the navigation pane on the left, choose Policies.
5. Click the name of the target policy to go to the protection configuration page.
6. Click the Intelligent Access Control configuration area and toggle it on or off if needed.
   • : enabled.
   • : disabled.

7. Click Intelligent Threat Access Control. On the displayed page, configure parameters by referring to Table 1.
   Figure 1 Configure WAF Rule
   

   Table 1 Parameters for generating an intelligent rule

   Rule	Parameter	Description
   CC Attack Protection Rule	Action	Protective actions Log only, Block, and JS Challenge are supported. Log only: WAF only logs detected attacks. Block: WAF blocks and logs detected attacks. JS Challenge: WAF returns a piece of JavaScript code that can be automatically executed by a normal browser to the client. If the client properly executes the JavaScript code, WAF allows all requests from the client within a period of time (30 minutes by default). During this period, no verification is required. If the client fails to execute the code, WAF blocks the requests.
   	Maximum Age	When the attack stops, WAF will delete this rule after this amount of time has passed.
   Precise Protection Rule	Action	Protective actions Log only and Block are supported. Log only: WAF only logs detected attacks. Block: WAF blocks and logs detected attacks.
   	Maximum Age	When the attack stops, WAF will delete this rule after this amount of time has passed.
   Intelligent Dynamic Rate Limit	Protective Action	Protective actions Log only, Block, and JS Challenge are supported. Log only: WAF only logs detected attacks. Block: WAF blocks and logs detected attacks. JS Challenge: WAF returns a piece of JavaScript code that can be automatically executed by a normal browser to the client. If the client properly executes the JavaScript code, WAF allows all requests from the client within a period of time (30 minutes by default). During this period, no verification is required. If the client fails to execute the code, WAF blocks the requests.
   	Protection Level	If WAF blocks normal website requests, you can change the protection level. If you select the loose level, there will be fewer false positives, but also more false negatives. If you select the tight level, the opposite is true. Three levels are supported: Loose, Normal, Tight.
   	Minimum Threshold	The request traffic will be limited based on the minimum threshold or the learned baseline rate, whichever is larger. If the learned baseline rate is smaller than the number you set for Minimum Threshold, WAF limits request traffic based on the minimum threshold you set. If the learned baseline rate is greater than the number you set for Minimum Threshold, WAF limits the request traffic based on the learned baseline rate.

8. Click Confirm.

   You can click View WAF Rule to check the protection rules automatically generated by WAF after it detects CC attacks.