RockCloud-基石云安全-官方博客
How to Implement API DDoS Protection: Architecture for Mitigating Multi-Vector Attacks Without Blocking Legitimate Clients
This article addresses API services such as app backends, payment gateways, and AI model interfaces, analyzing the characteristics of multi-vector DDoS attacks combining Layer 4 traffic floods and Layer 7 concurrency. It explores how to implement API DDoS protection without affecting legitimate clients and callback notifications, using Anycast scrubbing, intelligent WAF exception rules, TLS 1.3 0-RTT acceleration, and fixed peak billing architecture.
How BGP Anycast Scrubbing Works: Traffic Steering, Layered Filtering, and Origin Injection
BGP Anycast scrubbing works in three steps: multiple scrubbing nodes announce the same IP range, pulling traffic and attacks to the nearest nodes; each node filters at layers 3/4 and 7; clean traffic is then sent back to the origin via reverse proxy or tunnel.
How to Handle Live Streaming Push Stream Lag from CC Attacks: Locate the Damaged Layer First, Then Stop the Bleeding in Order
When live streaming lags or frequently disconnects, spend the first ten minutes determining whether the signaling/auth API is being flooded, the playback side is penetrating back to the origin and saturating it, or the push port is being exhausted by empty connections, then apply rate limiting, cache convergence, and port closure at the corresponding layer.
Website Under DDoS Attack? 5-Step Emergency Recovery Sequence
When a website is being hit by DDoS or CC attacks, quick recovery depends on the right sequence: first identify the attack layer, isolate the origin server (change IP if necessary), switch DNS to a mitigation node, suppress application-layer traffic at the edge, and finally clean up lingering connections.
How to Hide Your Origin Server: 5 Defense Layers from Exposure to mTLS Origin Pull
Learn a 5-layer defense strategy to hide your origin server from direct attacks, covering exposure cleanup, DNS resolution lockdown, network whitelisting, mTLS authentication, and edge capacity.
