Overview
StrataGateway DDoS Protection is intended to preserve infrastructure and network availability during denial-of-service events. By implementing edge network filtering and automated traffic controls, the platform aims to shield compute workloads from disruptive network traffic spikes.
DDoS protection architecture is currently being designed and implemented alongside the StrataGateway network platform. Protection scope, threshold detection, and mitigation capabilities are subject to refinement before public release.
Development Disclaimer
StrataGateway does not claim unlimited mitigation capacity, proprietary global scrubbing centers, 100% uptime guarantees, or zero-downtime protection during extreme attack events.
Threat model
Denial-of-service attacks seek to overwhelm infrastructure resources, rendering hosted applications unreachable or slow. Understanding the distinction between network-level and application-level threats helps define the scope of StrataGateway protection.
Volumetric attacks
Planned CoverageTarget: Network bandwidth & port capacity
Attempts to consume available network capacity through massive volumes of incoming traffic, flooding network interfaces and edge links.
Protocol attacks
Planned CoverageTarget: Network & transport protocols
Attempts to exhaust or abuse network and protocol-handling state tables on infrastructure, compute targets, or intermediate networking devices.
Application-layer attacks
Customer / App LayerTarget: Application logic & web servers
Targets application behavior, API endpoints, or database resources rather than raw network capacity. Requires application-level defenses.
Protection architecture
Traffic destined for StrataGateway resources passes through multi-stage inspection and filtering layers before entering host interfaces.
1. Internet Traffic
Inbound traffic streams
2. Network Edge
Ingress traffic evaluation
3. Detection Layer
Anomaly & volume analysis
4. Mitigation / Filtering
Selective traffic drop
5. StrataGateway Network
Internal regional routing
6. Customer Resource
Clean traffic arrival
Protection may combine StrataGateway platform controls with capabilities available from underlying network infrastructure. The architecture will evolve as regional footprints expand.
Detection
In Development / Planned
Automated detection mechanisms monitor network traffic signals to identify anomalies suggestive of volumetric or protocol abuse.
Sudden volume shifts
Rapid deviations from historical traffic baselines.
Abnormal packet rates
Unusual packets-per-second spikes on specific IP destinations.
Protocol anomalies
Malformed IP headers or unexpected TCP/UDP flag patterns.
Destination saturation
Sustained traffic approaching interface capacity limits.
Unexpected traffic patterns
Asymmetric traffic bursts or suspicious origin clustering.
Network health signals
Degradation in edge packet processing metrics.
Mitigation workflow
When anomalous network conditions trigger detection limits, the platform initiates an automated mitigation workflow to isolate and drop harmful traffic.
1. Traffic Anomaly
Traffic volume or packet characteristics exceed expected baseline bounds.
2. Detection & Validation
Automated platform monitors validate anomaly authenticity.
3. Mitigation Activation
Edge filtering rules and rate controls dynamically engage.
4. Traffic Filtering
Unwanted traffic is dropped while clean packets pass through.
5. Monitoring & Removal
Telemetry tracks attack status; rules disengage once traffic normalizes.
Mitigation behavior may differ depending on attack type, target destination, region, network architecture, and underlying infrastructure features.
Network-layer protection
StrataGateway intends to focus protection mechanisms at the network and transport layers to safeguard public IP endpoints and compute host availability.
Edge Filtering
Filters suspicious network packets at edge network ingress points before reaching internal host interfaces.
Rate Controls
Restricts packet ingestion rates during extreme traffic surges to preserve underlying interface integrity.
Planned features emphasize overall platform availability. Detailed implementation mechanics will reflect final network deployment specifications.
Protected resources
DDoS protection coverage is planned across core StrataGateway public infrastructure resources.
Final protection scope may differ between product families, network tiers, and geographical regions.
Traffic handling
Active mitigations categorize incoming packets into distinct operational streams to maintain maximum legitimate access while suppressing attack traffic.
Legitimate Traffic
Normal operational flow
Forwarded directly to target resource interface
Suspicious Traffic
Potential minor delay during severe traffic spikes
Evaluated against edge rate controls and network validation checks
Clearly Unwanted Traffic
Prevented from reaching internal network interfaces
Filtered or dropped at edge boundaries before reaching host interface
DDoS mitigation is probabilistic and operational in nature. Aggressive filtering during severe volumetric events may occasionally affect legitimate traffic streams.
Customer configuration
StrataGateway intends to deliver automated network protection out of the box, minimizing mandatory customer configuration while planning future visibility options.
Protection Visibility
PlannedReal-time indicators showing mitigation status and protection readiness across assigned public IPs.
Event History
PlannedHistorical log of detected network anomalies, mitigation start/stop times, and affected resources.
Destination Policies
Under EvaluationConfigurable sensitivity thresholds or policy profiles for specific compute workloads.
Notification Preferences
Under EvaluationAlert routing to webhook endpoints or notification channels when mitigations trigger.
Manual policy tuning and mitigation customization are not available in current preview builds.
Monitoring and visibility
DDoS status and mitigation metrics are planned to integrate directly into the central StrataGateway monitoring console.
Illustrative Attack Event
Status
Mitigation Active
Target IPv4
203.0.113.10
Started
2026-07-28T18:30:00Z
Traffic Trend
Elevated (Volumetric)
Example address from reserved documentation range (203.0.113.0/24).
Attack events
The platform will record lifecycle events throughout detected DDoS incidents to provide historical auditability.
ddos.detected
Triggered when network monitoring detects anomalous traffic patterns exceeding baseline thresholds.
ddos.mitigation_started
Triggered when automated filtering rules or edge rate controls are actively applied to incoming traffic.
ddos.mitigation_updated
Triggered when mitigation parameters or active filtering rules are dynamically adjusted.
ddos.mitigation_ended
Triggered when network conditions normalize and active mitigation filtering is removed.
API access
Illustrative Future API
DDoS protection event history and status indicators will be exposed via standard REST API endpoints.
Illustrative request
curl -X GET "https://api.stratagateway.com/v1/ddos/events" \
-H "Authorization: Bearer $STRATA_API_TOKEN"Illustrative response
{
"id": "ddos_evt_example",
"resource_id": "inst_7a91c2",
"status": "mitigating",
"category": "volumetric",
"started_at": "2026-07-28T18:30:00Z"
}Endpoint routes, request parameters, and response schemas are illustrative previews and are subject to change.
Read the REST API previewLimitations
Platform Limitations & Boundaries
- DDoS protection features are under active architecture design and development.
- No network protection system can guarantee complete mitigation of all possible attack vectors.
- Protection availability and capability scope may vary across compute plans and regional datacenters.
- Aggressive filtering under extreme conditions may impact a portion of legitimate traffic.
- Application-layer (L7) attacks require application-specific rate limits, WAF, or authentication.
- Exact bandwidth capacity limits (Tbps/Mpps) and activation response times are not published.
- Customer self-service rules and custom policy profiles are not currently supported.
Shared responsibility
Maintaining application availability during attack events requires shared coordination between platform network controls and customer workload security.
Operational guidance
To maximize resilience, customers should combine network DDoS protection with good infrastructure security practices.
DDoS protection and firewalls
DDoS Protection and Firewalls operate at different levels to secure compute resources.
Firewall Policy
Enforces user-configured access rules (e.g., allow TCP port 443, drop port 22 except from specific IPs).
DDoS Protection
Addresses abnormal, high-volume traffic surges designed to exhaust network interface capacity.
DDoS protection and security
Network availability protection is one essential pillar of the broader StrataGateway platform security posture.
Comprehensive Platform Security
Provider transparency
StrataGateway may combine platform-level controls with protection capabilities provided by underlying network infrastructure and tier-1 transit partners. The protection architecture will continue to evolve as StrataGateway expands its global infrastructure footprint.
Next steps
Next Section
API ReferenceExplore planned API schemas, endpoint definitions, and developer platform conventions.
Was this page helpful?