DDoS是把大量受控主机组成的僵尸网络与流量放大技术结合、以耗尽目标带宽或资源为目的的分布式拒绝服务攻击，核心是海量来源伪装与请求洪泛，能力包括流量清洗、近源压制、异常识别与弹性扩容。它解决的是攻击导致业务不可用与请求真假难辨的问题，并不解决攻击源头存在与业务暴露面过大的问题。
DDoS的核心是流量与识别，它可以帮助企业实现以下目标：
把恶意流量在到达业务前剥离。高防节点按特征识别并清洗异常流量，合法请求不受影响地透传到源站。清洗依赖流量特征与协议指纹识别，攻击流量伪装成正常请求时需要结合行为分析与速率突增判断，误判成本较高。
在骨干网侧就近压制。攻击流量在靠近来源的网络位置被就地收敛，避免带宽被沿途链路耗尽。近源压制在骨干网或运营商侧收敛流量，能显著降低清洗中心带宽压力，但对合作方响应速度有要求。
让异常模式被提前发现。请求速率、来源分布与协议指纹的变化被持续观测，攻击开始阶段即可告警。异常检测需要历史基线支撑，新型攻击在最初阶段可能仍落在正常区间，检测规则需要随攻击演进持续更新。
让容量可以在攻击期间临时放大。弹性带宽按需扩展，配合清洗服务保证业务在流量高峰下仍然可用。
总之，DDoS防护可以帮助企业实现业务连续性从被动中断到主动防御的转变，缩短攻击造成的不可用时长，减少业务损失与品牌影响，推动安全防护体系向可度量、可演练的方向演进。
翻译
DDoS protection is the combination of zombie networks built from large numbers of controlled hosts with traffic amplification techniques, where the purpose is to exhaust target bandwidth or resources through distributed denial-of-service attacks. Its core is massive source disguise and request flooding, with capabilities covering traffic scrubbing, near-source suppression, anomaly detection and elastic capacity expansion. It solves the problems of attacks making services unavailable and of genuine and malicious requests being hard to distinguish, but it does not solve the problems of attack sources existing and of an overly large exposed attack surface.
At the heart of DDoS defense is traffic handling and identification, which can help companies achieve the following:
Strip malicious traffic before it reaches the business. High-defense nodes identify and scrub anomalous traffic by signature, letting legitimate requests pass through to the origin unaffected.
Suppress traffic near the source. Attack traffic is converged in place on networks close to its origin, preventing bandwidth from being exhausted along intermediate links.
Detect anomalous patterns early. Changes in request rate, source distribution and protocol fingerprint are observed continuously, so alerts fire at the start of an attack rather than after.
Allow capacity to expand temporarily during an attack. Elastic bandwidth scales on demand and, together with scrubbing services, keeps the business available during traffic peaks.
In short, DDoS defense can help enterprises shift business continuity from passive outage to active defense, shorten the duration of unavailability caused by attacks, reduce business loss and brand impact, and push security protection systems toward measurable and rehearsable operations.
