Preventing DDoS attacks in APIGEE

[#1]

In some of the cases, we noticed the attack on our RESTful APIs that have been exposed for Mobile apps.

The attackers are using different IPs to fire the reqests which look very valid.

Is there any defence mechanisms that we can adopt to avoid DDoS? Can APIGEE handle DDoS attacks or we have to apply CDN soloutions like AKAMAI?

[sudheendras · Accepted solution]

That's a great question @vivek yadav

DDoS attacks are becoming larger and more common. Recent attacks have seen record setting levels of traffic and predictions are that it will continue to get worse.

How does Apigee approach DDoS defense?

Network Level Defense: The Apigee Edge managed cloud platform is currently deployed and operated by Apigee (Google), on GCP (Google Cloud Platform) and AWS (Amazon Web Services), and therefore leverages DDoS defenses offered by both cloud hosting providers, at a network level.

Policies enforced within Apigee Edge: Apigee Edge can be used for implementing policies that protect customer APIs from attack. These policies are enforced on the API proxy that sits between an API client and the customer backend, and include policies such as Quotas, Spike arrests, Concurrent Rate Limiting, XML and JSON injection protection, and other policies that can be written to defend against specific attacks. See: http://docs.apigee.com/api-services/content/rate-limiting http://docs.apigee.com/api-services/reference/reference-overview-policy

Bot Detection through Apigee Sense: Apigee (Google) offers a Bot Detection service called Apigee Sense. Sense is an intelligent data driven API security product that detects and protects APIs from malicious or unwanted traffic. Sense provides another layer of protection by automatically identifying suspicious API client behaviors, upon which administrators can apply corrective actions in order to maintain user experience as well as protect backend systems. Sense is specifically built to address the requirement you mentioned. For further information, see: http://docs.apigee.com/sense/content/what-apigee-sense

Hope this helps!

[danielhoenig]

@sudheendras, @Dino-at-Google - Is this answer still valid for preventing DDOS attacks on our Apigee Proxies? Has anything changed since this answer was given?

[#4]

Thanks Sudheendra.

Last week we faced a DDoS attack and somehow APIGEE sense was not of great help. It was not rejecting the calls. Also guess there is very limited documentation and support from APIGEE available.

I do not think APIGEE Sense maintains blacklisted IP database and rejects calls originating form blacklisted IPs.

It needs to be more mature like AKAMAI.