[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eAdaptive Protection primarily detects and responds to Layer 7 (L7) DDoS attacks, such as HTTP GET or POST floods, which often start slowly and escalate, making them difficult to identify in real-time.\u003c/p\u003e\n"],["\u003cp\u003eOnce trained on normal traffic patterns, Adaptive Protection can quickly detect attacks and suggest Web Application Firewall (WAF) rules to block malicious traffic while allowing legitimate users continued access.\u003c/p\u003e\n"],["\u003cp\u003eAdaptive Protection alerts include detailed attack signatures with metadata, a suggested blocking rule, and a confidence score to facilitate rapid incident response and mitigation.\u003c/p\u003e\n"],["\u003cp\u003eUsers can report false positives to help Adaptive Protection refine its detection models, making them more accurate over time for each specific application's traffic patterns.\u003c/p\u003e\n"]]],[],null,["# Google Cloud Armor Adaptive Protection use cases\n\nThis document presents some common use cases for Google Cloud Armor Adaptive Protection.\n\n### L7 DDoS attack detection and protection\n\nThe most common use case for Adaptive Protection is detecting\nand responding to L7 DDoS attacks such as HTTP GET floods, HTTP POST floods, or\nother high frequency HTTP activities. L7 DDoS attacks often start relatively\nslow and grow in intensity over time. By the time humans or automated spike\ndetection mechanisms detect an attack, it is likely to be high in intensity and\nalready having a strong negative impact on the application. Critically, while it\nis possible to observe the spiking traffic in aggregate, it is much harder to\ndifferentiate, in real time, individual requests as malicious or not because\nthey appear as normal, fully formed requests. Similarly, since the attack\nsources are distributed amongst botnets or other groups of malicious clients\nranging in size from thousands to millions, it becomes increasingly difficult to\nmitigate an ongoing attack by systematically identifying and blocking bad\nclients based on IP alone. In the case of DDoS, the result is that the attack is\nsuccessful in making the targeted service unavailable for some or all regular\nusers.\n| **Note:** Adaptive Protection is intended to detect and alert on high frequency traffic coming from single or distributed sources. Manual or automated malicious activity is not guaranteed to be detected by Adaptive Protection, particularly if the incoming traffic looks just like legitimate traffic at similar volumes.\n[](/static/armor/images/caap-http-flood-attack.svg) Illustration of an L7 DDoS attack (HTTP GET flood). A successful attack might overwhelm the targeted application and prevent legitimate users from accessing the service. (click to enlarge)\n\nTo rapidly detect and respond to L7 DDoS attacks, the project or security policy\nowner can enable Adaptive Protection protection on a per-security policy\nbasis in their project. After at least one hour of training and observing normal\ntraffic patterns, Adaptive Protection will be ready to quickly and\naccurately detect an attack early in its lifecycle and suggest WAF rules to\nblock the ongoing attack while leaving normal users unaffected.\n[](/static/armor/images/caap-detect-protect.svg) Adaptive Protection identifies and mitigates an L7 DDoS attack, allowing legitimate users to access the application. (click to enlarge)\n\nNotifications of potential attacks and the identified signature of the suspect\ntraffic are sent to Logging, where the log message can trigger a\ncustom Alerting Policy, be analyzed and stored, or be sent to a downstream\nsecurity information and event management (SIEM) or log management solution.\nConsult the [Logging documentation](/logging/docs) for more\ninformation on how to integrate downstream SIEM or log management.\n\n### Attack signature detection and response\n\nIt is critical to not only detect and alert on potential attacks early but also\nbe able to act on that alert and respond in time to mitigate the attacks. An\nenterprise's incident responders have to spend critical minutes and hours\ninvestigating, frequently analyzing logs and monitoring systems to gather enough\ninformation to develop a response to an ongoing attack. Next, before deploying\nthe mitigation, that plan has to be validated to make sure it won't have an\nunintended or negative impact on production workloads.\n[](/static/armor/images/caap-incident-response.svg) A common workflow for an enterprise's incident response process. (click to enlarge)\n\nWith Adaptive Protection, incident responders have everything they need to\nquickly analyze and respond to an ongoing L7 DDoS attack the moment they receive\nthe alert. The Adaptive Protection alert includes the signature of the\ntraffic determined to be participating in the potential attack. The contents of\nthe signature will include metadata about the incoming traffic, including the\nset of malicious HTTP request headers, source geographies, etc. The alert also\nincludes a rule matching the attack signature that can be applied in\nCloud Armor to immediately block the malicious traffic.\n\nThe Adaptive Protection event provides a confidence score and a projected\nimpacted baseline rate associated with the suggested rule to aid in\nvalidation. Each component of the signature also has measures for attack\nlikelihood and proportion of attack to enable incident responders to fine tune\nand narrow or widen the scope of the response.\n\n### Customizing the model and reporting event errors\n\nThe Adaptive Protection attack detection models are trained on a data set,\nartificially produced to exhibit the characteristics of both the good and the\nmalicious traffic. As a result, it is possible that Adaptive Protection will\nidentify a potential attack that, upon additional investigation, the incident\nresponder or application owner will determine was not an attack.\nAdaptive Protection is able to learn from the unique context and traffic\npatterns of each protected application.\n[](/static/armor/images/caap-identify-respond.svg) Example signature of a potential attack. (click to enlarge)\n\nYou can report individual alerts as a false positive to further help\nAdaptive Protection train and customize the detection models. With false\npositive reports, Adaptive Protection models will be less likely to alert on\ntraffic with similar characteristics and attributes in the future. Over time,\nthe Adaptive Protection detection models will be more attuned to the\nspecific characteristics of the traffic in each protected security policy. The\nsteps to report false positive events were described in [Monitoring, feedback\nand reporting event errors](/armor/docs/adaptive-protection-overview#monitor-%0Afeedback-report-errors).\n\nWhat's next\n-----------\n\n- [Read more about Google Cloud Armor Adaptive Protection](/armor/docs/adaptive-protection-overview)."]]
