Protect

Core Protection

Core Protection provides an at-a-glance view of protection status of a website.

• Select Protect > Core Protection.

Protection Summary

Attack Summary

Attack summary displays the number of DDOS attacks, Bot attacks, Geo and IP attacks prevented for selected time.

Total Attacks Blocked

Blocked attacks majorly DDOS attacks, Bot attacks, known vulnerabilities, Custom rule, and Other attacks. Total attacks blocked is displayed on pie chart with attacks count.

Top Attacks

Up to top 5 attacks data is displayed with percentage value. Click drop-down menu to filter the top attacks data by attack category, URI, and Countries.

A) Top attacks by Categories

Select Categories option from drop-down menu to view the different category of attacks. Most common attacks categories are denial-of-service attack, SQL injection, Cross-Site Scripting, Command injection, Bot attacks and so on. The maximum number of attacks will be displayed in percentage by descending order.

B) Top attacks by URI

Select URI option from drop-down menu to view the Top URIs. The maximum number of attacks will be displayed in percentage by descending order.

C) Top attacks by Countries

Select Countries option from drop-down menu to view the maximum number of attacks from a region in percentage by descending order.

Attack Trend

Attack trend display the no. of bot attacks, DDOS attacks blocked and attacks of other category blocked as per the selection. Attacks severity is categorized as critical, high, and medium. Each severity level is defined with an unique color.

To display a specific severity such as high, click critical and medium options to strike or disable these options and view only the graph of high vulnerabilities.

Attack Summary - Top 50

Attack summary includes both blocked and logged attacks.

Mouse over any specific attack trend peak to view the details.

A drop-down menu is given to filter the data like Attacks by IP, Attacks by Category, Attacks by URLs.

Click View Details icon of a specific IP address. Attack Trend pop-up appears.

The attack trend is displayed with all the three critical, high, and medium attacks for a week or month as per the selection.

Payload

Whitelist IP

To whitelist a specific IP address, click Allow IP button. A confirmation pop-up appears.

Click Confirm button to allow the IP address otherwise, click Cancel button.

Blacklist IP

To blacklist a specific IP address, click Block IP button. A confirmation pop-up appears.

Click Confirm button to proceed with the action otherwise, click Cancel button.

Blacklist Country

To blacklist a specific country as there are lot of attacks from it, click Block Country button. A confirmation pop-up appears.

Click Confirm button to proceed with the action otherwise, click Cancel button.

Behavioral DDOS Protection

This page provides customers with the ability to manage different protection policies created by AppTrana.

• Select Protect > Behavioral DDOS Protection.

AppTrana Protection Policy Types

AppTrana offers two different policy types for protection.

1. System Defined Protection Policies- These are predefined policies created by system based on the parameters such as Host, IP, and Session.

   Three system defined policies are available all time for customers. 1.      App rate limiting policy 2.      IP rate limiting policy 3.      Session rate limiting policy

2. User Defined Protection Policies- These policies are created by customers as per customer’s preference.

System Defined Protection Policies

Customers can not delete any policy from System Defined protection Policies. Only customer can either Activate or Deactivate it.

Edit Policy

• Choose the policy you want to edit and click Edit Policy icon.

  

Customers can only edit a policy when the policy is on activated mode.

• Inside policy page customers can update the rate limiting, action, and so on.

  

Click Save to apply changes.

A confirmation pop-up will appear to save changes in the policy.

Click Yes to proceed with the changes. A success pop-up will appears.

User Defined Protection Policies

User defined protection policies allow customers to create own policies and provide more access to manage DDOS protection.

Create a New policy

• Click Create New Policy.

  

• Select a policy type you want to create and click Confirm. For details, Click AppTrana Protection Policy Types.

For Example: Customer wants to create a IP Rate limiting Policy.

• Enter the name in Policy Name field. By default, Policy severity is selected as Critical.

• Set IP Rate Limiting: Customers can set IP Rate limiting by using formula( such as median or max of last 2 previous weeks data) or by entering a number.

Use formula to set IP rate limit:

1. Select the Formula radio button.
2. Enter a percentage value or select any percentage value from drop-down menu. In drop-down menu four defined values such as 100%, 150%, 200%, and 500% are given.

1. Max and Median options are given in drop-down.

   

For Max:

As per the above graph, the maximum requests (P99.99) for last week are 2750.  

When you increase the percentage value from 100 to 200 percentage of the max value (that is 2750), IP rate limiting will be changed to 5500. 

For Median:

As per the above graph, the median request for last week is 1. When you increase the percentage value from 100 to 200, IP rate limiting will be set as 2 requests. 

• Go to Execute Action field, a drop- down is given to choose the action when the policy is breached. Also, customers can get the executed action details to their mail box by providing a valid email address.

• Click Create Policy and a confirmation pop-up will appear.

  

Click Yes and a success pop-up will be displayed.

Rate limiting by Host level: 

Walk through the following example for better understanding: 

 At 00.01 AM,  

The number of requests received from IP – A is 10 

The number of requests received from IP – B is 20 

The number of requests received from IP – C is 30 

Total requests received at 8.00 AM is A+B+C, that is (10+20+30) 60. 

At 00.02 AM,  

The number of requests received from IP – X is 30 

The number of requests received from IP – Y is 20 

The number of requests received from IP – Z is 20 during session D 

The number of requests received from IP – Z is 30 during session D1 

The number of requests received from IP – Z is 50 during session D2 

Total requests received at 8.01 AM is X+Y+Z, (Z= D+D1+D2), that is (30+20+(20+30+50)) 150. 

Like this, the total number of requests received in each minute is calculated. 

For a day, 24 hours and for an hour 60 minutes, and total is 1440 minutes. 

All the requests received for each minute will be put in ascending order.  

(Example: 60,150,180,190,198,269...700, total 1440 entries) 

P99 is the maximum number of requests received, that is 700. 

 P75 will be 75th percentile of total requests received, that is (1440*0.75 =1080).  

Requests received at 1080 entry is the P75 value, that is 450. 

Rate Limiting by IP Level: 

Walk through the following example for better understanding: 

At 00:01 AM, 

The number of requests received from IP – A is 10 

The number of requests received from IP – B is 20 

The number of requests received from IP – C is 30 

At 00.02 AM,  

The number of requests received from IP – X is 50 

The number of requests received from IP – Y is 70 

The number of requests received from IP – Z is 20 during session D 

The number of requests received from IP – Z is 30 during session D1 

The number of requests received from IP – Z is 50 during session D2 

Here, from IP – Z total requests received is (Z= D+D1+D2) 100. 

All the requests received from different IPs will be put in ascending order.  

Case study: We have received requests from 6 different IP addresses.  

That is [IPs-A, B, C, X, Y, Z] and requests are [10,20,30,50,70,100] 

P99 is the maximum number of requests received, that is 100 

P75: will be the number of IPs *0.75, that is (6*0.75= 4.5) 5.  

Requests received at 5th entry is the P75, that is 70. 

Rate Limiting by Session Level: 

Walk through the following example for better understanding: 

At 00:01 AM, 

The number of requests received from IP – A and Session – A is 10 

The number of requests received from IP – B and Session – B is 20 

The number of requests received from IP – C and Session – C is 30 

At 00.02 AM,   

The number of requests received from IP – X and Session – X is 30 

The number of requests received from IP – Y and Session – Y is 100 

The number of requests received from IP – Z and Session – Z is 200 

The number of requests received from IP – Z and Session – Z1 is 300 

The number of requests received from IP – Z and Session – Z2 is 500 

All the requests received from different IPs and different sessions will be put in ascending order.  

Case study: We have received requests from 6 different IP addresses and 8 different sessions. 

That is [IPs- A, B, C, X, Y, Z], [Sessions- A, B, C, X, Y, Z, Z1, Z2], and requests are  

[10, 20, 30, 30, 100, 200, 300, 500]. 

P99 is the maximum number of requests received in which session, that is 500. 

P75 is percentile of total sessions. 

P75= [(Total number of sessions=8) * 0.75=6] 

Requests received at 6th entry is the P75, that is 200. 

Deactivate and Delete a policy

Customers can Deactivate and Delete any User defined policy.

Deactivate:

• Select a policy from user defined policies and click power icon to deactivate.

  

• A confirmation pop-up will appear. Click Confirm to deactivate the policy.

• A success pop-up will appear. Click Okay to close the pop-up.

Activated Policy power icons are displayed in green color. Deactivated Policy power icons are displayed in orange color.

• To activate the policy again, select the deactivated policy and click power icon.

Click confirm and a success pop-up will be displayed. Click Okay to close the pop-up.

Delete:

• Select a policy from user defined policies and click delete icon.

A confirmation pop-up will appear. Click Confirm to delete the policy.

A success pop-up will appear and click Okay to close the pop-up.

Note: Deleted policies can't be retrieved, once it is deleted from the list.

URI-Based DDoS Policy 

In line with our Behavioral DDoS feature, we have released the URI-based DDoS Protection feature to provide granular security for our AppTrana customers. 

Steps to Create a URI Based DDoS Policy 

1. Click on Create New Policy. 
2. Choose the IP URL Limiting Policy or Session URL Limiting Policy. 
3. Enter the URL (/example1.php) and click on the Confirm button. 

• Now, you’ll be redirected to the policy page. 

The policy page includes the following details: 

• After entering all the details, click on the Create button. You’ll receive a confirmation pop-up and then, click on Yes. 
• Once the policy is ready, it will show up in the user- defined policies table.

• Click on the power icon to activate the policy. A confirmation pop-up will appear and then, click on the Confirm button. 

  

• A success/Status Confirmation pop-up will appear. Click on the Okay button to close the pop-up. 

  

•  Once the policy is activated, the Edit policy button will be enabled. 

Block Duration in IP Rate Limiting Policy

This is an advanced feature designed only for the AppTrana Advance Plus and Premium customers to improve their BDDoS Protection 

This feature helps users to set the block duration to an IP when the no. of requests to that IP exceeds the rate limit. 

AppTrana users can set the block duration by selecting a particular time span. Time spans are given in five modes, they are 2mins, 5mins, 10mins, 30mins, and 60mins respectively. 

If any IP exceeds its rate limit, the same IP will be automatically blocked for the above selected block duration. 

How it works? 

1. Click Protect > Behavioral DDoS Protection and choose a website. 
2. Go to the System Defined polices/User Defined Policies section. 
3. Select any IP rate limiting policy and click Edit policy icon. 

   

1. Set the IP rate limit by using the formula or enter the value manually. 
2. Select the LOG_AND_BLOCK option as executive action. 
3. Click the drop-down menu in the Block Duration field and select any time span. (2mins, 5mins, 10mins, 30mins, or 60mins) 
4. Click Save to update the changes.  
5. A confirmation pop-up appears. Click Yes to confirm. 

BOT Protection