Cloudflare DDoS Protection: Advanced Defense Against Modern Attacks#

Introduction#

Cloudflare’s DDoS protection is one of the largest networks globally, capable of mitigating attacks exceeding 1 Tbps. With 330+ cities across 120+ countries, Cloudflare automatically detects and blocks malicious traffic before it reaches your origin server.

Attack Statistics (2024)#

Largest DDoS attack: 3.8 Tbps (Q1 2024)
Daily attacks blocked: 140+ billion threats
Zero downtime: Guaranteed availability during attacks
Sub-second detection: Average mitigation time < 10 seconds
No traffic cap: Unlimited DDoS protection

DDoS Attack Types and Mitigation#

1. Volumetric Attacks (Layer 3/4)#

1
graph TB
2
    subgraph "Volumetric Attack Mitigation"
3
        A[Attacker Botnet] -->|Flood Traffic| CF[Cloudflare Edge]
4
        CF -->|Analysis| AI[AI/ML Detection]
5
        AI -->|Block| BLOCK[Blocked Traffic]
6
        AI -->|Allow| CLEAN[Clean Traffic]
7
        CLEAN --> ORIGIN[Origin Server]
8

9
        style BLOCK fill:#ff6b6b
10
        style CLEAN fill:#90EE90
11
        style CF fill:#87CEEB
12
    end

UDP Flood Protection#

1
// Advanced UDP flood detection in Workers
2
export default {
3
  async fetch(request, env, ctx) {
4
    const clientIP = request.headers.get('CF-Connecting-IP');
5
    const country = request.cf.country;
6

7
    // Check for suspicious patterns
8
    if (await detectUDPFlood(clientIP, env)) {
9
      return new Response('Blocked: Potential UDP flood', {
10
        status: 429,
11
        headers: {
12
          'X-Block-Reason': 'UDP-Flood-Detection',
13
          'Retry-After': '300'
14
        }
15
      });
16
    }
17

18
    return fetch(request);
19
  }
20
};
21

22
async function detectUDPFlood(ip, env) {
23
  const key = `udp-flood:${ip}`;
24
  const requests = await env.KV.get(key);
25
  const count = requests ? parseInt(requests) : 0;
26

27
  // More than 1000 requests per minute from single IP
28
  if (count > 1000) {
29
    // Add to security list for extended blocking
30
    await env.KV.put(`blocked:${ip}`, 'udp-flood', { expirationTtl: 3600 });
31
    return true;
32
  }
33

34
  // Increment counter
35
  await env.KV.put(key, (count + 1).toString(), { expirationTtl: 60 });
36
  return false;
37
}

DNS Amplification Defense#

1
# DNS amplification attack detection
2
import asyncio
3
from datetime import datetime, timedelta
4

5
class DNSAmplificationDetector:
6
    def __init__(self, cf_api):
7
        self.cf_api = cf_api
8
        self.suspicious_patterns = {
9
            'query_types': ['ANY', 'TXT', 'RRSIG'],
10
            'query_sizes': range(512, 4096),  # Suspicious query sizes
11
            'response_ratios': 10  # Response 10x larger than query
12
        }
13

14
    async def analyze_dns_traffic(self, zone_id):
15
        """Analyze DNS queries for amplification patterns"""
16
        end_time = datetime.utcnow()
17
        start_time = end_time - timedelta(minutes=5)
18

19
        dns_analytics = await self.cf_api.get_dns_analytics(
20
            zone_id=zone_id,
21
            since=start_time.isoformat(),
22
            until=end_time.isoformat()
23
        )
24

25
        suspicious_sources = {}
26

27
        for query in dns_analytics['queries']:
28
            source_ip = query['source_ip']
29
            query_type = query['query_type']
30
            query_size = query['query_size']
31
            response_size = query['response_size']
32

33
            # Calculate amplification ratio
34
            amp_ratio = response_size / query_size if query_size > 0 else 0
35

36
            # Check for suspicious patterns
37
            if (query_type in self.suspicious_patterns['query_types'] or
38
                query_size in self.suspicious_patterns['query_sizes'] or
39
                amp_ratio > self.suspicious_patterns['response_ratios']):
40

41
                if source_ip not in suspicious_sources:
42
                    suspicious_sources[source_ip] = {
43
                        'queries': 0,
44
                        'total_amplification': 0,
45
                        'suspicious_types': set()
46
                    }
47

48
                suspicious_sources[source_ip]['queries'] += 1
49
                suspicious_sources[source_ip]['total_amplification'] += amp_ratio
50
                suspicious_sources[source_ip]['suspicious_types'].add(query_type)
51

52
        # Block IPs with high suspicion scores
53
        for ip, data in suspicious_sources.items():
54
            if data['queries'] > 50 or data['total_amplification'] > 500:
55
                await self.block_ip(ip, 'dns-amplification', zone_id)
56

57
        return suspicious_sources
58

59
    async def block_ip(self, ip, reason, zone_id):
60
        """Add IP to security rules"""
61
        rule = {
62
            "mode": "block",
63
            "configuration": {
64
                "target": "ip",
65
                "value": ip
66
            },
67
            "notes": f"Auto-blocked for {reason} at {datetime.utcnow().isoformat()}"
68
        }
69

70
        await self.cf_api.create_access_rule(zone_id, rule)

2. Protocol Attacks (Layer 3/4)#

SYN Flood Protection#

1
# SYN flood detection and mitigation
2
class SYNFloodProtection:
3
    def __init__(self, cf_api, threshold=1000):
4
        self.cf_api = cf_api
5
        self.threshold = threshold
6
        self.syn_tracking = {}
7

8
    async def monitor_syn_packets(self, zone_id):
9
        """Monitor SYN packet rates"""
10
        # Get connection analytics from Cloudflare
11
        analytics = await self.cf_api.get_network_analytics(
12
            zone_id=zone_id,
13
            metrics=['syn_packets', 'connection_attempts'],
14
            time_window=60  # 1 minute
15
        )
16

17
        for data_point in analytics:
18
            source_ip = data_point['source_ip']
19
            syn_rate = data_point['syn_packets_per_second']
20

21
            if syn_rate > self.threshold:
22
                await self.implement_syn_cookies(source_ip, zone_id)
23

24
                # If still excessive, block
25
                if syn_rate > self.threshold * 5:
26
                    await self.block_ip_temporary(source_ip, 'syn-flood', zone_id)
27

28
    async def implement_syn_cookies(self, ip, zone_id):
29
        """Enable SYN cookies for specific IP"""
30
        firewall_rule = {
31
            "filter": {
32
                "expression": f'ip.src eq {ip}'
33
            },
34
            "action": "challenge",
35
            "products": ["ddos"],
36
            "description": f"SYN cookie challenge for {ip}"
37
        }
38

39
        await self.cf_api.create_firewall_rule(zone_id, firewall_rule)
40

41
    async def block_ip_temporary(self, ip, reason, zone_id, duration=300):
42
        """Temporarily block IP"""
43
        rule = {
44
            "mode": "block",
45
            "configuration": {
46
                "target": "ip",
47
                "value": ip
48
            },
49
            "notes": f"Temp block: {reason}",
50
            "timeout": duration
51
        }
52

53
        await self.cf_api.create_temporary_rule(zone_id, rule)

3. Application Layer Attacks (Layer 7)#

HTTP Flood Protection#

1
// Advanced HTTP flood detection
2
export class HTTPFloodProtection {
3
  constructor(env) {
4
    this.env = env;
5
    this.rateLimits = {
6
      requests_per_minute: 300,
7
      requests_per_hour: 2000,
8
      burst_threshold: 50,
9
      suspicious_user_agents: [
10
        'curl', 'wget', 'python-requests', 'bot', 'crawler'
11
      ]
12
    };
13
  }
14

15
  async analyzeRequest(request) {
16
    const clientIP = request.headers.get('CF-Connecting-IP');
17
    const userAgent = request.headers.get('User-Agent') || '';
18
    const method = request.method;
19
    const url = new URL(request.url);
20
    const path = url.pathname;
21

22
    // Calculate request patterns
23
    const patterns = await this.calculatePatterns(clientIP, request);
24

25
    // Risk scoring
26
    let riskScore = 0;
27

28
    // High request rate
29
    if (patterns.requests_per_minute > this.rateLimits.requests_per_minute) {
30
      riskScore += 50;
31
    }
32

33
    // Burst detection
34
    if (patterns.burst_rate > this.rateLimits.burst_threshold) {
35
      riskScore += 30;
36
    }
37

38
    // Suspicious user agent
39
    if (this.rateLimits.suspicious_user_agents.some(ua =>
40
        userAgent.toLowerCase().includes(ua))) {
41
      riskScore += 20;
42
    }
43

44
    // Unusual request patterns
45
    if (patterns.unique_paths_ratio < 0.1) { // Hitting same endpoints
46
      riskScore += 25;
47
    }
48

49
    // Geographic anomalies
50
    if (patterns.country_switches > 3) {
51
      riskScore += 15;
52
    }
53

54
    return {
55
      riskScore,
56
      patterns,
57
      action: this.determineAction(riskScore)
58
    };
59
  }
60

61
  async calculatePatterns(ip, request) {
62
    const now = Date.now();
63
    const minute_window = 60 * 1000;
64
    const hour_window = 60 * 60 * 1000;
65

66
    // Get request history
67
    const history_key = `req_history:${ip}`;
68
    const history = JSON.parse(await this.env.KV.get(history_key) || '[]');
69

70
    // Filter recent requests
71
    const recent_requests = history.filter(req => now - req.timestamp < hour_window);
72
    const minute_requests = recent_requests.filter(req => now - req.timestamp < minute_window);
73

74
    // Add current request
75
    const current_request = {
76
      timestamp: now,
77
      path: new URL(request.url).pathname,
78
      method: request.method,
79
      user_agent: request.headers.get('User-Agent'),
80
      country: request.cf.country
81
    };
82

83
    recent_requests.push(current_request);
84

85
    // Store updated history (keep last 2000 requests)
86
    await this.env.KV.put(history_key, JSON.stringify(recent_requests.slice(-2000)), {
87
      expirationTtl: 7200 // 2 hours
88
    });
89

90
    // Calculate patterns
91
    const unique_paths = new Set(recent_requests.map(r => r.path)).size;
92
    const unique_countries = new Set(recent_requests.map(r => r.country)).size;
93

94
    // Burst detection (requests in last 10 seconds)
95
    const burst_window = 10 * 1000;
96
    const burst_requests = recent_requests.filter(req => now - req.timestamp < burst_window);
97

98
    return {
99
      requests_per_minute: minute_requests.length,
100
      requests_per_hour: recent_requests.length,
101
      unique_paths_ratio: unique_paths / recent_requests.length,
102
      country_switches: unique_countries,
103
      burst_rate: burst_requests.length,
104
      methods_used: new Set(recent_requests.map(r => r.method)).size,
105
      user_agent_consistency: this.calculateUAConsistency(recent_requests)
106
    };
107
  }
108

109
  calculateUAConsistency(requests) {
110
    const user_agents = requests.map(r => r.user_agent).filter(ua => ua);
111
    if (user_agents.length === 0) return 0;
112

113
    const unique_uas = new Set(user_agents);
114
    return unique_uas.size / user_agents.length;
115
  }
116

117
  determineAction(riskScore) {
118
    if (riskScore >= 80) {
119
      return 'block';
120
    } else if (riskScore >= 60) {
121
      return 'challenge';
122
    } else if (riskScore >= 40) {
123
      return 'rate_limit';
124
    } else if (riskScore >= 20) {
125
      return 'monitor';
126
    }
127
    return 'allow';
128
  }
129
}
130

131
// Usage in Worker
132
export default {
133
  async fetch(request, env, ctx) {
134
    const protection = new HTTPFloodProtection(env);
135
    const analysis = await protection.analyzeRequest(request);
136

137
    switch (analysis.action) {
138
      case 'block':
139
        return new Response('Blocked: Suspicious activity', {
140
          status: 403,
141
          headers: {
142
            'X-Block-Reason': 'HTTP-Flood',
143
            'X-Risk-Score': analysis.riskScore.toString()
144
          }
145
        });
146

147
      case 'challenge':
148
        return new Response('Please solve the challenge', {
149
          status: 429,
150
          headers: {
151
            'X-Challenge-Required': 'true',
152
            'CF-Challenge': 'javascript'
153
          }
154
        });
155

156
      case 'rate_limit':
157
        // Implement rate limiting
158
        return new Response('Rate limited', {
159
          status: 429,
160
          headers: {
161
            'Retry-After': '60',
162
            'X-Rate-Limit-Reason': 'Suspicious-Pattern'
163
          }
164
        });
165

166
      default:
167
        return fetch(request);
168
    }
169
  }
170
};

Intelligent Rate Limiting#

Advanced Rate Limiting Rules#

1
rules:
2
  - name: "API Endpoint Protection"
3
    expression: 'http.request.uri.path matches "^/api/"'
4
    rate_limit:
5
      threshold: 100
6
      period: 60
7
      action: block
8
      duration: 300
9

10
  - name: "Login Endpoint Protection"
11
    expression: 'http.request.uri.path eq "/login" and http.request.method eq "POST"'
12
    rate_limit:
13
      threshold: 5
14
      period: 60
15
      action: challenge
16
      duration: 600
17

18
  - name: "Search Rate Limiting"
19
    expression: 'http.request.uri.path contains "/search"'
20
    rate_limit:
21
      threshold: 20
22
      period: 60
23
      action: rate_limit
24
      duration: 60
25

26
  - name: "Admin Panel Protection"
27
    expression: 'http.request.uri.path matches "^/admin/"'
28
    rate_limit:
29
      threshold: 10
30
      period: 300
31
      action: block
32
      duration: 3600
33
      bypass:
34
        - whitelist_ip
35
        - known_admin_tokens
36

37
  - name: "File Upload Limiting"
38
    expression: 'http.request.method eq "POST" and http.request.uri.path contains "/upload"'
39
    rate_limit:
40
      threshold: 3
41
      period: 300
42
      action: challenge
43
      duration: 900

Dynamic Rate Limiting Implementation#

1
// dynamic-rate-limiting.js - Adaptive rate limiting based on traffic patterns
2
export class DynamicRateLimiting {
3
  constructor(env) {
4
    this.env = env;
5
    this.baseLimits = {
6
      '/api/': { requests: 100, window: 60 },
7
      '/login': { requests: 5, window: 60 },
8
      '/search': { requests: 20, window: 60 },
9
      default: { requests: 300, window: 60 }
10
    };
11
  }
12

13
  async calculateDynamicLimit(path, clientIP, request) {
14
    const baseLimit = this.getBaseLimit(path);
15
    const trafficMetrics = await this.getTrafficMetrics();
16
    const clientTrust = await this.calculateClientTrust(clientIP);
17

18
    // Adjust based on global traffic
19
    let multiplier = 1;
20

21
    // During high traffic, reduce limits
22
    if (trafficMetrics.requests_per_second > 10000) {
23
      multiplier *= 0.5;
24
    } else if (trafficMetrics.requests_per_second > 5000) {
25
      multiplier *= 0.7;
26
    }
27

28
    // Adjust based on attack indicators
29
    if (trafficMetrics.attack_probability > 0.8) {
30
      multiplier *= 0.3;
31
    } else if (trafficMetrics.attack_probability > 0.5) {
32
      multiplier *= 0.6;
33
    }
34

35
    // Adjust based on client trust score
36
    if (clientTrust.score > 0.8) {
37
      multiplier *= 1.5; // Trusted clients get higher limits
38
    } else if (clientTrust.score < 0.3) {
39
      multiplier *= 0.4; // Untrusted clients get lower limits
40
    }
41

42
    // Geographic adjustments
43
    const country = request.cf.country;
44
    if (['CN', 'RU', 'KP'].includes(country)) {
45
      multiplier *= 0.6; // Higher risk countries
46
    }
47

48
    return {
49
      requests: Math.floor(baseLimit.requests * multiplier),
50
      window: baseLimit.window,
51
      multiplier,
52
      factors: {
53
        traffic: trafficMetrics.requests_per_second,
54
        attack_prob: trafficMetrics.attack_probability,
55
        client_trust: clientTrust.score,
56
        country
57
      }
58
    };
59
  }
60

61
  async getTrafficMetrics() {
62
    const metrics_key = 'global_traffic_metrics';
63
    const cached_metrics = await this.env.KV.get(metrics_key);
64

65
    if (cached_metrics) {
66
      return JSON.parse(cached_metrics);
67
    }
68

69
    // Calculate metrics from recent requests
70
    const requests = await this.getRecentRequests();
71
    const now = Date.now();
72
    const minute_ago = now - 60000;
73

74
    const recent_requests = requests.filter(r => r.timestamp > minute_ago);
75
    const requests_per_second = recent_requests.length / 60;
76

77
    // Calculate attack probability based on patterns
78
    const attack_indicators = {
79
      high_error_rate: this.calculateErrorRate(recent_requests) > 0.1,
80
      unusual_traffic_spike: requests_per_second > this.getBaselineRPS() * 5,
81
      suspicious_user_agents: this.countSuspiciousUAs(recent_requests) > recent_requests.length * 0.3,
82
      geographic_anomalies: this.detectGeoAnomalies(recent_requests)
83
    };
84

85
    const attack_probability = Object.values(attack_indicators).filter(Boolean).length / Object.keys(attack_indicators).length;
86

87
    const metrics = {
88
      requests_per_second,
89
      attack_probability,
90
      error_rate: this.calculateErrorRate(recent_requests),
91
      unique_ips: new Set(recent_requests.map(r => r.ip)).size
92
    };
93

94
    // Cache for 10 seconds
95
    await this.env.KV.put(metrics_key, JSON.stringify(metrics), { expirationTtl: 10 });
96

97
    return metrics;
98
  }
99

100
  async calculateClientTrust(ip) {
101
    const trust_key = `client_trust:${ip}`;
102
    const cached_trust = await this.env.KV.get(trust_key);
103

104
    if (cached_trust) {
105
      return JSON.parse(cached_trust);
106
    }
107

108
    const history = await this.getClientHistory(ip);
109
    let trust_score = 0.5; // Start neutral
110

111
    // Positive indicators
112
    if (history.successful_requests > 1000) trust_score += 0.1;
113
    if (history.error_rate < 0.05) trust_score += 0.1;
114
    if (history.days_active > 30) trust_score += 0.1;
115
    if (history.consistent_patterns) trust_score += 0.1;
116
    if (history.human_like_behavior) trust_score += 0.1;
117

118
    // Negative indicators
119
    if (history.security_violations > 0) trust_score -= 0.3;
120
    if (history.error_rate > 0.2) trust_score -= 0.2;
121
    if (history.suspicious_patterns > 5) trust_score -= 0.2;
122
    if (history.rapid_requests > 10) trust_score -= 0.1;
123

124
    trust_score = Math.max(0, Math.min(1, trust_score));
125

126
    const trust_data = {
127
      score: trust_score,
128
      last_updated: Date.now(),
129
      factors: history
130
    };
131

132
    // Cache for 5 minutes
133
    await this.env.KV.put(trust_key, JSON.stringify(trust_data), { expirationTtl: 300 });
134

135
    return trust_data;
136
  }
137

138
  getBaseLimit(path) {
139
    for (const [pattern, limit] of Object.entries(this.baseLimits)) {
140
      if (pattern === 'default') continue;
141
      if (path.startsWith(pattern) || path.includes(pattern)) {
142
        return limit;
143
      }
144
    }
145
    return this.baseLimits.default;
146
  }
147

148
  async enforceRateLimit(clientIP, path, limit) {
149
    const key = `rate_limit:${clientIP}:${path}`;
150
    const requests = await this.env.KV.get(key);
151
    const count = requests ? parseInt(requests) : 0;
152

153
    if (count >= limit.requests) {
154
      return {
155
        allowed: false,
156
        remaining: 0,
157
        reset: Date.now() + (limit.window * 1000),
158
        limit: limit.requests
159
      };
160
    }
161

162
    // Increment counter
163
    await this.env.KV.put(key, (count + 1).toString(), {
164
      expirationTtl: limit.window
165
    });
166

167
    return {
168
      allowed: true,
169
      remaining: limit.requests - count - 1,
170
      reset: Date.now() + (limit.window * 1000),
171
      limit: limit.requests
172
    };
173
  }
174

175
  calculateErrorRate(requests) {
176
    if (requests.length === 0) return 0;
177
    const errors = requests.filter(r => r.status >= 400).length;
178
    return errors / requests.length;
179
  }
180

181
  getBaselineRPS() {
182
    // Return baseline RPS based on historical data
183
    return 100; // Simplified
184
  }
185

186
  countSuspiciousUAs(requests) {
187
    const suspicious_patterns = ['bot', 'crawler', 'curl', 'wget', 'scanner'];
188
    return requests.filter(r =>
189
      suspicious_patterns.some(pattern =>
190
        r.user_agent?.toLowerCase().includes(pattern)
191
      )
192
    ).length;
193
  }
194

195
  detectGeoAnomalies(requests) {
196
    const countries = requests.map(r => r.country).filter(c => c);
197
    const unique_countries = new Set(countries);
198

199
    // Anomaly if traffic from too many countries in short time
200
    return unique_countries.size > 20;
201
  }
202

203
  async getRecentRequests() {
204
    // Simplified - in production, use analytics API
205
    return [];
206
  }
207

208
  async getClientHistory(ip) {
209
    // Simplified - return basic history structure
210
    return {
211
      successful_requests: 0,
212
      error_rate: 0,
213
      days_active: 0,
214
      consistent_patterns: false,
215
      human_like_behavior: false,
216
      security_violations: 0,
217
      suspicious_patterns: 0,
218
      rapid_requests: 0
219
    };
220
  }
221
}
222

223
// Worker implementation
224
export default {
225
  async fetch(request, env, ctx) {
226
    const rateLimiter = new DynamicRateLimiting(env);
227
    const url = new URL(request.url);
228
    const clientIP = request.headers.get('CF-Connecting-IP');
229

230
    const dynamicLimit = await rateLimiter.calculateDynamicLimit(
231
      url.pathname,
232
      clientIP,
233
      request
234
    );
235

236
    const rateLimitResult = await rateLimiter.enforceRateLimit(
237
      clientIP,
238
      url.pathname,
239
      dynamicLimit
240
    );
241

242
    if (!rateLimitResult.allowed) {
243
      return new Response('Rate limit exceeded', {
244
        status: 429,
245
        headers: {
246
          'X-RateLimit-Limit': dynamicLimit.requests.toString(),
247
          'X-RateLimit-Remaining': '0',
248
          'X-RateLimit-Reset': rateLimitResult.reset.toString(),
249
          'X-RateLimit-Multiplier': dynamicLimit.multiplier.toString(),
250
          'Retry-After': dynamicLimit.window.toString()
251
        }
252
      });
253
    }
254

255
    const response = await fetch(request);
256

257
    // Add rate limit headers to successful responses
258
    response.headers.set('X-RateLimit-Limit', dynamicLimit.requests.toString());
259
    response.headers.set('X-RateLimit-Remaining', rateLimitResult.remaining.toString());
260
    response.headers.set('X-RateLimit-Reset', rateLimitResult.reset.toString());
261

262
    return response;
263
  }
264
};

Bot Management Integration#

Advanced Bot Detection#

1
// bot-detection.js - ML-powered bot detection
2
export class AdvancedBotDetection {
3
  constructor(env) {
4
    this.env = env;
5
    this.botSignatures = {
6
      user_agents: [
7
        'Googlebot', 'Bingbot', 'Slurp', 'facebookexternalhit',
8
        'Twitterbot', 'LinkedInBot', 'WhatsApp', 'SkypeUriPreview'
9
      ],
10
      malicious_patterns: [
11
        'nikto', 'sqlmap', 'nmap', 'masscan', 'zap', 'w3af'
12
      ],
13
      headless_indicators: [
14
        'HeadlessChrome', 'PhantomJS', 'SlimerJS', 'HtmlUnit'
15
      ]
16
    };
17
  }
18

19
  async detectBot(request) {
20
    const features = await this.extractFeatures(request);
21
    const botProbability = await this.calculateBotProbability(features);
22

23
    return {
24
      isBot: botProbability > 0.7,
25
      probability: botProbability,
26
      botType: this.identifyBotType(features),
27
      confidence: this.calculateConfidence(features),
28
      features
29
    };
30
  }
31

32
  async extractFeatures(request) {
33
    const userAgent = request.headers.get('User-Agent') || '';
34
    const acceptHeader = request.headers.get('Accept') || '';
35
    const acceptLanguage = request.headers.get('Accept-Language') || '';
36
    const acceptEncoding = request.headers.get('Accept-Encoding') || '';
37

38
    return {
39
      // User Agent features
40
      ua_length: userAgent.length,
41
      ua_entropy: this.calculateEntropy(userAgent),
42
      ua_known_bot: this.botSignatures.user_agents.some(bot =>
43
        userAgent.includes(bot)),
44
      ua_malicious: this.botSignatures.malicious_patterns.some(pattern =>
45
        userAgent.toLowerCase().includes(pattern)),
46
      ua_headless: this.botSignatures.headless_indicators.some(indicator =>
47
        userAgent.includes(indicator)),
48

49
      // Header features
50
      headers_count: request.headers.size,
51
      has_accept: !!acceptHeader,
52
      has_accept_language: !!acceptLanguage,
53
      has_accept_encoding: !!acceptEncoding,
54
      has_dnt: request.headers.has('DNT'),
55
      has_referer: request.headers.has('Referer'),
56

57
      // Request features
58
      method: request.method,
59
      has_body: request.method !== 'GET' && request.method !== 'HEAD',
60
      url_length: request.url.length,
61

62
      // Timing features (would need implementation)
63
      request_timing: await this.getRequestTiming(request),
64

65
      // Behavioral features
66
      session_consistency: await this.checkSessionConsistency(request),
67

68
      // TLS features (from CF object)
69
      tls_version: request.cf?.tlsVersion || '',
70
      tls_cipher: request.cf?.tlsCipher || '',
71

72
      // Geographic features
73
      country: request.cf?.country || '',
74
      asn: request.cf?.asn || '',
75

76
      // Custom headers
77
      cf_ray: request.headers.get('CF-RAY') || '',
78
      cf_ipcountry: request.headers.get('CF-IPCountry') || ''
79
    };
80
  }
81

82
  async calculateBotProbability(features) {
83
    let score = 0;
84
    let weights = 0;
85

86
    // Known bot patterns
87
    if (features.ua_known_bot) {
88
      score += 0.9 * 10; // Likely legitimate bot
89
      weights += 10;
90
    }
91

92
    if (features.ua_malicious) {
93
      score += 0.95 * 15; // Likely malicious bot
94
      weights += 15;
95
    }
96

97
    if (features.ua_headless) {
98
      score += 0.8 * 8; // Headless browser
99
      weights += 8;
100
    }
101

102
    // Header analysis
103
    if (!features.has_accept_language) {
104
      score += 0.6 * 3; // Missing common headers
105
      weights += 3;
106
    }
107

108
    if (!features.has_accept) {
109
      score += 0.7 * 4;
110
      weights += 4;
111
    }
112

113
    if (features.headers_count < 5) {
114
      score += 0.5 * 2; // Too few headers
115
      weights += 2;
116
    }
117

118
    // User agent entropy (too low = likely bot)
119
    if (features.ua_entropy < 3.0) {
120
      score += 0.6 * 3;
121
      weights += 3;
122
    }
123

124
    // Behavioral patterns
125
    if (!features.session_consistency) {
126
      score += 0.4 * 2;
127
      weights += 2;
128
    }
129

130
    // Request timing (too fast = likely bot)
131
    if (features.request_timing.avg_interval < 100) { // milliseconds
132
      score += 0.7 * 5;
133
      weights += 5;
134
    }
135

136
    return weights > 0 ? Math.min(1, score / weights) : 0;
137
  }
138

139
  identifyBotType(features) {
140
    if (features.ua_malicious) return 'malicious';
141
    if (features.ua_headless) return 'headless';
142
    if (features.ua_known_bot) return 'search_engine';
143

144
    // Heuristic classification
145
    if (features.request_timing.requests_per_minute > 60) {
146
      return 'scraper';
147
    }
148

149
    if (!features.has_accept_language && !features.has_referer) {
150
      return 'automated';
151
    }
152

153
    return 'unknown';
154
  }
155

156
  calculateConfidence(features) {
157
    let confidence = 0.5; // Base confidence
158

159
    // Strong indicators increase confidence
160
    if (features.ua_known_bot || features.ua_malicious) confidence += 0.3;
161
    if (features.ua_headless) confidence += 0.2;
162

163
    // Multiple weak indicators
164
    const weak_indicators = [
165
      !features.has_accept_language,
166
      !features.has_accept,
167
      features.headers_count < 5,
168
      features.ua_entropy < 3.0
169
    ].filter(Boolean).length;
170

171
    confidence += weak_indicators * 0.1;
172

173
    return Math.min(1, confidence);
174
  }
175

176
  calculateEntropy(str) {
177
    const freq = {};
178
    for (const char of str) {
179
      freq[char] = (freq[char] || 0) + 1;
180
    }
181

182
    let entropy = 0;
183
    const length = str.length;
184

185
    for (const count of Object.values(freq)) {
186
      const p = count / length;
187
      entropy -= p * Math.log2(p);
188
    }
189

190
    return entropy;
191
  }
192

193
  async getRequestTiming(request) {
194
    const ip = request.headers.get('CF-Connecting-IP');
195
    const timing_key = `timing:${ip}`;
196

197
    const now = Date.now();
198
    const history = JSON.parse(await this.env.KV.get(timing_key) || '[]');
199

200
    // Add current request
201
    history.push(now);
202

203
    // Keep last 100 requests
204
    const recent = history.slice(-100);
205
    await this.env.KV.put(timing_key, JSON.stringify(recent), {
206
      expirationTtl: 3600
207
    });
208

209
    if (recent.length < 2) {
210
      return { avg_interval: 0, requests_per_minute: 0 };
211
    }
212

213
    // Calculate intervals
214
    const intervals = [];
215
    for (let i = 1; i < recent.length; i++) {
216
      intervals.push(recent[i] - recent[i-1]);
217
    }
218

219
    const avg_interval = intervals.reduce((a, b) => a + b, 0) / intervals.length;
220
    const requests_in_last_minute = recent.filter(t => now - t < 60000).length;
221

222
    return {
223
      avg_interval,
224
      requests_per_minute: requests_in_last_minute
225
    };
226
  }
227

228
  async checkSessionConsistency(request) {
229
    // Simplified session consistency check
230
    // In practice, this would analyze multiple requests from same IP
231
    return true;
232
  }
233
}
234

235
// Integration with DDoS protection
236
export default {
237
  async fetch(request, env, ctx) {
238
    const botDetector = new AdvancedBotDetection(env);
239
    const detection = await botDetector.detectBot(request);
240

241
    if (detection.isBot) {
242
      // Log bot detection
243
      ctx.waitUntil(
244
        env.ANALYTICS.writeDataPoint({
245
          blobs: [
246
            detection.botType,
247
            request.headers.get('CF-Connecting-IP'),
248
            request.headers.get('User-Agent')
249
          ],
250
          doubles: [detection.probability],
251
          indexes: [`bot-${detection.botType}`]
252
        })
253
      );
254

255
      // Handle based on bot type
256
      switch (detection.botType) {
257
        case 'malicious':
258
          return new Response('Access denied', {
259
            status: 403,
260
            headers: {
261
              'X-Block-Reason': 'Malicious-Bot',
262
              'X-Bot-Probability': detection.probability.toString()
263
            }
264
          });
265

266
        case 'scraper':
267
          // Rate limit scrapers heavily
268
          return new Response('Rate limited', {
269
            status: 429,
270
            headers: {
271
              'Retry-After': '300',
272
              'X-Bot-Type': 'Scraper'
273
            }
274
          });
275

276
        case 'search_engine':
277
          // Allow but monitor search engines
278
          break;
279

280
        default:
281
          // Challenge unknown bots
282
          return new Response('Please verify you are human', {
283
            status: 429,
284
            headers: {
285
              'CF-Challenge': 'javascript'
286
            }
287
          });
288
      }
289
    }
290

291
    return fetch(request);
292
  }
293
};

Analytics and Monitoring#

Real-time Attack Dashboard#

1
// attack-dashboard.js - Real-time DDoS attack monitoring
2
export class AttackDashboard {
3
  constructor(env) {
4
    this.env = env;
5
  }
6

7
  async generateDashboard() {
8
    const metrics = await this.collectMetrics();
9
    const dashboard = await this.createDashboardHTML(metrics);
10

11
    return new Response(dashboard, {
12
      headers: {
13
        'Content-Type': 'text/html',
14
        'Cache-Control': 'no-cache, no-store, must-revalidate'
15
      }
16
    });
17
  }
18

19
  async collectMetrics() {
20
    const now = Date.now();
21
    const hour_ago = now - (60 * 60 * 1000);
22

23
    // Collect various metrics
24
    const [
25
      requestMetrics,
26
      threatMetrics,
27
      geoMetrics,
28
      botMetrics
29
    ] = await Promise.all([
30
      this.getRequestMetrics(hour_ago, now),
31
      this.getThreatMetrics(hour_ago, now),
32
      this.getGeoMetrics(hour_ago, now),
33
      this.getBotMetrics(hour_ago, now)
34
    ]);
35

36
    return {
37
      timestamp: now,
38
      requests: requestMetrics,
39
      threats: threatMetrics,
40
      geography: geoMetrics,
41
      bots: botMetrics,
42
      summary: this.generateSummary(requestMetrics, threatMetrics)
43
    };
44
  }
45

46
  async getRequestMetrics(start, end) {
47
    // Simulate request metrics - in production, use Analytics API
48
    return {
49
      total_requests: 1500000,
50
      requests_per_second: 2500,
51
      bytes_served: 15000000000, // 15GB
52
      unique_visitors: 45000,
53
      status_codes: {
54
        '200': 1350000,
55
        '301': 75000,
56
        '404': 45000,
57
        '403': 15000,
58
        '429': 12000,
59
        '500': 3000
60
      },
61
      top_paths: [
62
        { path: '/', requests: 450000 },
63
        { path: '/api/data', requests: 235000 },
64
        { path: '/login', requests: 123000 },
65
        { path: '/search', requests: 98000 }
66
      ]
67
    };
68
  }
69

70
  async getThreatMetrics(start, end) {
71
    return {
72
      threats_blocked: 25000,
73
      attack_types: {
74
        'http_flood': 12000,
75
        'layer7_ddos': 8000,
76
        'malicious_bot': 3500,
77
        'sql_injection': 1200,
78
        'xss_attempt': 300
79
      },
80
      threat_sources: {
81
        'CN': 8500,
82
        'RU': 6200,
83
        'US': 3100,
84
        'BR': 2800,
85
        'IN': 2400,
86
        'Other': 2000
87
      },
88
      mitigation_methods: {
89
        'rate_limit': 15000,
90
        'block': 8000,
91
        'challenge': 2000
92
      }
93
    };
94
  }
95

96
  async getGeoMetrics(start, end) {
97
    return {
98
      top_countries: [
99
        { country: 'US', requests: 450000, threats: 1200 },
100
        { country: 'GB', requests: 180000, threats: 300 },
101
        { country: 'DE', requests: 150000, threats: 250 },
102
        { country: 'FR', requests: 120000, threats: 200 },
103
        { country: 'CA', requests: 100000, threats: 150 },
104
        { country: 'CN', requests: 90000, threats: 8500 },
105
        { country: 'RU', requests: 70000, threats: 6200 }
106
      ]
107
    };
108
  }
109

110
  async getBotMetrics(start, end) {
111
    return {
112
      bot_requests: 125000,
113
      bot_types: {
114
        'search_engine': 85000,
115
        'scraper': 25000,
116
        'malicious': 10000,
117
        'headless': 3500,
118
        'automated': 1500
119
      },
120
      bot_actions: {
121
        'allowed': 85000,
122
        'rate_limited': 25000,
123
        'blocked': 10000,
124
        'challenged': 5000
125
      }
126
    };
127
  }
128

129
  generateSummary(requests, threats) {
130
    const threat_percentage = ((threats.threats_blocked / requests.total_requests) * 100).toFixed(2);
131
    const attack_intensity = threats.threats_blocked > 50000 ? 'HIGH' :
132
                           threats.threats_blocked > 10000 ? 'MEDIUM' : 'LOW';
133

134
    return {
135
      threat_percentage,
136
      attack_intensity,
137
      primary_threat: Object.keys(threats.attack_types)
138
        .reduce((a, b) => threats.attack_types[a] > threats.attack_types[b] ? a : b),
139
      top_threat_country: Object.keys(threats.threat_sources)
140
        .reduce((a, b) => threats.threat_sources[a] > threats.threat_sources[b] ? a : b)
141
    };
142
  }
143

144
  async createDashboardHTML(metrics) {
145
    return `
146
<!DOCTYPE html>
147
<html lang="en">
148
<head>
149
    <meta charset="UTF-8">
150
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
151
    <title>DDoS Protection Dashboard</title>
152
    <style>
153
        * { margin: 0; padding: 0; box-sizing: border-box; }
154
        body {
155
            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
156
            background: #0f1419;
157
            color: #ffffff;
158
            line-height: 1.6;
159
        }
160
        .dashboard {
161
            max-width: 1400px;
162
            margin: 0 auto;
163
            padding: 20px;
164
        }
165
        .header {
166
            text-align: center;
167
            margin-bottom: 30px;
168
            padding: 20px;
169
            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
170
            border-radius: 10px;
171
        }
172
        .stats-grid {
173
            display: grid;
174
            grid-template-columns: repeat(auto-fit, minmax(280px, 1fr));
175
            gap: 20px;
176
            margin-bottom: 30px;
177
        }
178
        .stat-card {
179
            background: #1a202c;
180
            padding: 20px;
181
            border-radius: 10px;
182
            border-left: 4px solid #4299e1;
183
        }
184
        .stat-card h3 {
185
            color: #4299e1;
186
            margin-bottom: 10px;
187
        }
188
        .stat-number {
189
            font-size: 2em;
190
            font-weight: bold;
191
            color: #ffffff;
192
        }
193
        .threat-high { border-left-color: #e53e3e !important; }
194
        .threat-medium { border-left-color: #ed8936 !important; }
195
        .threat-low { border-left-color: #38a169 !important; }
196
        .charts-grid {
197
            display: grid;
198
            grid-template-columns: 1fr 1fr;
199
            gap: 20px;
200
            margin-bottom: 30px;
201
        }
202
        .chart-container {
203
            background: #1a202c;
204
            padding: 20px;
205
            border-radius: 10px;
206
        }
207
        .table-container {
208
            background: #1a202c;
209
            padding: 20px;
210
            border-radius: 10px;
211
            overflow-x: auto;
212
        }
213
        table {
214
            width: 100%;
215
            border-collapse: collapse;
216
        }
217
        th, td {
218
            padding: 12px;
219
            text-align: left;
220
            border-bottom: 1px solid #2d3748;
221
        }
222
        th {
223
            background: #2d3748;
224
            color: #4299e1;
225
        }
226
        .status-indicator {
227
            display: inline-block;
228
            width: 10px;
229
            height: 10px;
230
            border-radius: 50%;
231
            margin-right: 10px;
232
        }
233
        .status-active { background-color: #38a169; }
234
        .status-warning { background-color: #ed8936; }
235
        .status-critical { background-color: #e53e3e; }
236
        .refresh-timer {
237
            position: fixed;
238
            top: 20px;
239
            right: 20px;
240
            background: #1a202c;
241
            padding: 10px 20px;
242
            border-radius: 25px;
243
            border: 1px solid #4299e1;
244
        }
245
        @media (max-width: 768px) {
246
            .charts-grid { grid-template-columns: 1fr; }
247
            .dashboard { padding: 10px; }
248
        }
249
    </style>
250
</head>
251
<body>
252
    <div class="refresh-timer">
253
        Auto-refresh: <span id="timer">60</span>s
254
    </div>
255

256
    <div class="dashboard">
257
        <div class="header">
258
            <h1>🛡️ DDoS Protection Dashboard</h1>
259
            <p>Real-time threat monitoring and mitigation status</p>
260
            <p><small>Last updated: ${new Date(metrics.timestamp).toLocaleString()}</small></p>
261
        </div>
262

263
        <div class="stats-grid">
264
            <div class="stat-card">
265
                <h3>Total Requests</h3>
266
                <div class="stat-number">${metrics.requests.total_requests.toLocaleString()}</div>
267
                <p>${metrics.requests.requests_per_second.toLocaleString()} req/sec</p>
268
            </div>
269

270
            <div class="stat-card threat-${metrics.summary.attack_intensity.toLowerCase()}">
271
                <h3>Threats Blocked</h3>
272
                <div class="stat-number">${metrics.threats.threats_blocked.toLocaleString()}</div>
273
                <p>${metrics.summary.threat_percentage}% of traffic</p>
274
            </div>
275

276
            <div class="stat-card">
277
                <h3>Unique Visitors</h3>
278
                <div class="stat-number">${metrics.requests.unique_visitors.toLocaleString()}</div>
279
                <p>Last hour</p>
280
            </div>
281

282
            <div class="stat-card">
283
                <h3>Bot Requests</h3>
284
                <div class="stat-number">${metrics.bots.bot_requests.toLocaleString()}</div>
285
                <p>${Math.round((metrics.bots.bot_requests / metrics.requests.total_requests) * 100)}% of traffic</p>
286
            </div>
287
        </div>
288

289
        <div class="charts-grid">
290
            <div class="chart-container">
291
                <h3>🎯 Attack Types</h3>
292
                <table>
293
                    ${Object.entries(metrics.threats.attack_types)
294
                      .sort(([,a], [,b]) => b - a)
295
                      .map(([type, count]) => `
296
                        <tr>
297
                            <td>${type.replace(/_/g, ' ').toUpperCase()}</td>
298
                            <td style="text-align: right">${count.toLocaleString()}</td>
299
                        </tr>
300
                      `).join('')}
301
                </table>
302
            </div>
303

304
            <div class="chart-container">
305
                <h3>🌍 Threat Sources</h3>
306
                <table>
307
                    ${Object.entries(metrics.threats.threat_sources)
308
                      .sort(([,a], [,b]) => b - a)
309
                      .map(([country, count]) => `
310
                        <tr>
311
                            <td>${country}</td>
312
                            <td style="text-align: right">${count.toLocaleString()}</td>
313
                        </tr>
314
                      `).join('')}
315
                </table>
316
            </div>
317
        </div>
318

319
        <div class="table-container">
320
            <h3>🌐 Geographic Traffic Distribution</h3>
321
            <table>
322
                <thead>
323
                    <tr>
324
                        <th>Country</th>
325
                        <th>Legitimate Requests</th>
326
                        <th>Threats</th>
327
                        <th>Threat Ratio</th>
328
                        <th>Status</th>
329
                    </tr>
330
                </thead>
331
                <tbody>
332
                    ${metrics.geography.top_countries.map(country => {
333
                        const threat_ratio = (country.threats / country.requests * 100).toFixed(2);
334
                        const status_class = threat_ratio > 10 ? 'critical' : threat_ratio > 5 ? 'warning' : 'active';
335
                        return `
336
                        <tr>
337
                            <td>${country.country}</td>
338
                            <td>${country.requests.toLocaleString()}</td>
339
                            <td>${country.threats.toLocaleString()}</td>
340
                            <td>${threat_ratio}%</td>
341
                            <td>
342
                                <span class="status-indicator status-${status_class}"></span>
343
                                ${status_class.charAt(0).toUpperCase() + status_class.slice(1)}
344
                            </td>
345
                        </tr>
346
                        `;
347
                    }).join('')}
348
                </tbody>
349
            </table>
350
        </div>
351
    </div>
352

353
    <script>
354
        let countdown = 60;
355
        const timerElement = document.getElementById('timer');
356

357
        setInterval(() => {
358
            countdown--;
359
            timerElement.textContent = countdown;
360

361
            if (countdown <= 0) {
362
                location.reload();
363
            }
364
        }, 1000);
365
    </script>
366
</body>
367
</html>
368
    `;
369
  }
370
}
371

372
// Dashboard endpoint
373
export default {
374
  async fetch(request, env) {
375
    const url = new URL(request.url);
376

377
    if (url.pathname === '/dashboard') {
378
      const dashboard = new AttackDashboard(env);
379
      return dashboard.generateDashboard();
380
    }
381

382
    return new Response('Not found', { status: 404 });
383
  }
384
};

Best Practices and Configuration#

Security Headers and WAF Rules#

1
# waf-rules.yaml - Comprehensive WAF configuration
2
security_rules:
3
  - name: "SQL Injection Protection"
4
    expression: |
5
      (http.request.body matches "(?i)(union|select|insert|delete|drop|create|alter|exec|script)" and
6
       http.request.uri.path contains "search") or
7
      (http.request.uri.query contains "1=1" or
8
       http.request.uri.query contains "' or " or
9
       http.request.uri.query contains "admin'--")
10
    action: block
11

12
  - name: "XSS Protection"
13
    expression: |
14
      http.request.uri.query contains "<script" or
15
      http.request.uri.query contains "javascript:" or
16
      http.request.body matches "(?i)<script[^>]*>.*?</script>"
17
    action: block
18

19
  - name: "Path Traversal Protection"
20
    expression: |
21
      http.request.uri.path contains "../" or
22
      http.request.uri.path contains "..\" or
23
      http.request.uri.path matches ".*\\.\\./.*"
24
    action: block
25

26
  - name: "Suspicious User Agents"
27
    expression: |
28
      http.request.headers["user-agent"] contains "sqlmap" or
29
      http.request.headers["user-agent"] contains "nikto" or
30
      http.request.headers["user-agent"] contains "nmap"
31
    action: block
32

33
  - name: "Rate Limit API Endpoints"
34
    expression: 'http.request.uri.path matches "^/api/"'
35
    rate_limit:
36
      threshold: 100
37
      period: 60
38
      action: challenge
39

40
security_headers:
41
  - name: "Content-Security-Policy"
42
    value: "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'"
43

44
  - name: "X-Frame-Options"
45
    value: "DENY"
46

47
  - name: "X-Content-Type-Options"
48
    value: "nosniff"
49

50
  - name: "Referrer-Policy"
51
    value: "strict-origin-when-cross-origin"
52

53
  - name: "Permissions-Policy"
54
    value: "geolocation=(), microphone=(), camera=()"

Conclusion#

Cloudflare’s DDoS protection offers comprehensive defense against modern threats:

✅ Multi-layer Protection: L3/L4 and L7 attack mitigation ✅ Global Scale: Absorb attacks up to 1 Tbps+ ✅ Intelligent Detection: AI/ML-powered threat analysis ✅ Zero Configuration: Automatic protection out-of-the-box ✅ Advanced Rate Limiting: Granular control over traffic ✅ Bot Management: Distinguish between good and bad bots ✅ Real-time Analytics: Comprehensive attack visibility ✅ No Performance Impact: Protection without latency

Key features:

Automatic DDoS mitigation
Advanced rate limiting
Bot management
Real-time analytics
Custom security rules
API-driven configuration

Start protecting your applications today at dash.cloudflare.com