UWAF - Web App Firewall UWAF

SCloud Web Application Firewall (UWAF) is a cloud-based distributed reverse proxy application firewall that uses the cloud with more resources and higher throughput to identify and filter traffic. In the increasingly severe network security situation, UWAF, which has features such as high availability, efficient interception of malicious traffic, access statistical analysis, application health monitoring, etc., and flexible management through the console or APIs, is an ideal solution for web security for enterprise users in various industries.

UWAF protects your web applications by blocking most web attacks that reduce application availability, security, or cause abnormal consumption utilization. It differs from traditional application firewalls in that you can pay as you go, open as you go, fast access, and convenient management. You can also combine UWAF as part of your network security solution with other security products such as Anti-DDoS Pro for more comprehensive security. In addition, UWAF can meet the requirements for equal protection.

Suitable for users

All customers who require Web Application Guard (applications or origin servers can not be deployed on SCloud).

Access method

• UWAF for SaaS: Deployments through CNAME resolution, domain name resolution directs traffic to the CNAME-protected domain name assigned by UWAF.
• UWAF for ULB: After purchase, add forwarding rules on the ULB side, and then add domain names on UWAF to perform web security detection on traffic without changing the original network link.

  Basic product functionality

• Protection against general web attacks (SQL injection, XSS attacks, etc.).
• Mainstream web vulnerability detection and protection, the latest high-risk vulnerability protection, virtual patches.
• CC (Challenge Collapsar) attack detection and prevention.
• Flexible custom protection policies.
• Various access and attack reports.

Feature description

SCloud Web Application Firewall (UWAF) is used to protect against internal and external security threats against web applications. Compatible with Anti-DDoS Pro (UDDoS), it can protect against network attacks such as injection, command execution, and CC that are common on the network in addition to the protection provided by Anti-DDoS Pro service.

Basic concepts

Enterprise-level web application firewall is deployed before the origin server, after purchase, the cname provided by ufaf is configured into the cname resolution of the domain name, and then all public network traffic will pass through ufaf, malicious attack traffic will be filtered, and normal traffic can be transmitted to the origin server through ufaf, thereby ensuring the security of the origin server.

Web Application Attack Protection

Comprehensive protection against the following attack types: SQL injection, XSS cross-site, WebShell, command injection, illegal HTTP protocol requests, common web server exploits, unauthorized access to core files, path traversal, etc. Provide functions such as backdoor isolation protection and scanning protection.

Fine-grained access control rules

Provides a friendly configuration console interface, supports the combination of conditions of common HTTP fields such as IP, URL, Referer, and User-Agent, creates a powerful precise access control policy, and supports protection scenarios such as hotlinking and website background protection.

It adopts linkage mechanism with security modules such as common web attack protection and CC protection to create a multi-layer comprehensive protection mechanism that can identify trusted and malicious traffic according to requirements.

Malicious CC attack protection

Control the access frequency of single-source IP, support redirect verification, and human identity.

In response to massive slow request attacks, comprehensive protection is carried out based on statistical response codes, URL request distribution, abnormal Referer and User-Agent feature recognition, and precise website access control.

Enrich reports

Provides rich attack and access reports to keep you informed of website status.

Black and white lists

• Blacklist: Block specified IP addresses or IP segments.
• Whitelist: Allows the specified IP address or IP range.

  Log query and download

  UWAF supports real-time query of 10,000 log queries online within 3 days. Provides log downloads (attack logs and access logs) for 7 days.

If you enable the Log Extension Pack service, you can download logs for up to 180 days (free for users of the Ultimate version or above).

Alarm management

Regularly send alert summary information of UWAF-related domain names to user mailboxes to remind you of risks.

Send alerts from UWAF-related domain names that trigger a large number of rules in a short period of time, and send alarms to users’ mailboxes or mobile phones to remind them of the risk of security incidents.

Send an alert that the origin server of the UWAF domain name is not responding normally in real time to the user’s mailbox to remind the user to check the origin server.

Send UWAF-related domain name request response status in real time, such as the proportion of status codes above 499 in the overall request is greater than 30%. An alert will be sent to the user’s email or mobile phone.

Product advantages

Low latency is more stable

Based on BGP line access, UWAF provides multi-line node disaster recovery and intelligent optimal path intelligent mobilization, with stable quality, millisecond-level response, and low latency.

Rules self-perfecting system

At present, mainstream WAFs are still based on feature matching, but in the face of increasingly complex and diverse attacks, the rule system based on feature matching often cannot be well protected. UWAF can also be based on machine learning, using the excellent generalization ability and automatic learning ability of the intelligent detection engine, which can be organically combined with the rule system to provide a more solid guarantee for the security of the customer’s website.

Automated elastic scalability

In the face of business uncertainty, UWAF has automatic elastic scaling capabilities, and uses SCloud’s powerful public cloud resource pool as a support, which can quickly expand its own services in the event of CC attacks or business emergencies, so there will be no performance bottleneck.

Powerful collaborative protection capabilities

SCloud leverages powerful cloud-based intelligence gathering capabilities, combined with intelligence from other intelligence vendors, to filter massive malicious access requests on UWAF with an intelligence base.

24/7 expert service

Anyone who purchases UWAF can enjoy 24/7 free expert service. For some complex attacks, when the machine or algorithm cannot accurately judge and block, SCloud’s security experts can intervene and assist, and make targeted protection measures for the attack scenario according to the hacker’s attack methods.

Overdue recycling

Alarm

The billing system sends alarm notifications to customers. Account managers manually submit reclaimed resources: Alerts customers within 10 minutes.

Automatically reclaimed resources:

Monthly and annual billing: an alarm is issued once in the morning on day 1, once on day 3, and once on day 6; Hourly billing: One alarm for the next 10 points.

Renewal

If you renew the subscription within 7 days after the alarm is sent, you can continue to use it normally and keep the original configuration.

Recycling policy

If the alert is not renewed after it is issued, the resource will be deleted 7 days after the first alarm is issued.

User deletion

If the user deletes the WAF during the use period, the equivalent fee for the elapsed time of the current month will be charged, and the remaining fee will be returned to the user’s account.

Version selection

If you are an enterprise user with certain requirements for disaster recovery and traffic, we recommend that you choose UWAF for the Enterprise Edition. If the service traffic is greater than 100 Mbps, we recommend that you select the appropriate UWAF version based on the size and importance of your service.

The trial version and premium version are offline, and the historical user configuration is retained and can continue to be used. For test drive users who have purchased a test drive for more than 3 months, configuration editing is restricted, that is, configurations cannot be added and modified, and user configurations that have already taken effect will not be affected.

Version comparison

× indicates that the feature is not supported in this version ULB stands for this item depending on the configuration of the ULB.

Function description

Illustrate: For more information about the availability zones supported by ULB Private Zone, see Price description. Non-standard ports are supported except for ports below 80.

Performance and quota comparison:

Illustrate: ULB Zone Edition: ULB Zone Edition WAF needs to bind at least one ULB, bind multiple ULBs for cumulative billing, and the version quota will also accumulate.

For example, binding 2 ULBs requires 7,300 RMB/month, supporting a total of 40 domain names, and other quotas will be doubled.

Total number of domain names/number of wildcard domain names: You can add 1 wildcard domain name for every 10 domain names, that is, under normal circumstances, you can only add 2 wildcard domains for the Enterprise Edition, and so on for other versions.

CC protection peak: The CC protection peak in the table is the value obtained by the experimental environment test, and the actual protection peak is related to the network environment and the number of new connections.

Malicious IP block*: If the attack type of a rule is All, only one rule can be set and no other attack types can be added. If you have rules with a specific attack type, you cannot add rules with an attack type of All.

If the version quota does not meet your needs, you can purchase the expansion pack, click Extension Pack for details

Parameter description

---