Operations

DDoS Protection

Understand the planned network-layer protections designed to improve infrastructure availability during denial-of-service events.

Planned

Development Preview

StrataGateway DDoS protection architecture is currently being designed alongside the network platform. Detection methods, mitigation workflows, traffic handling, filtering behavior, protection scope, thresholds, capacity, telemetry, and customer controls may change before public release.

Jump to article

Overview

StrataGateway DDoS Protection is intended to preserve infrastructure and network availability during denial-of-service events. By implementing edge network filtering and automated traffic controls, the platform aims to shield compute workloads from disruptive network traffic spikes.

Network-level attack detectionAutomated mitigation workflowsInfrastructure availability protectionMinimal customer interventionUseful attack visibilityIntegration with StrataGateway networkingPredictable operational behaviorNo application redesign required

DDoS protection architecture is currently being designed and implemented alongside the StrataGateway network platform. Protection scope, threshold detection, and mitigation capabilities are subject to refinement before public release.

Planned

Development Disclaimer

StrataGateway does not claim unlimited mitigation capacity, proprietary global scrubbing centers, 100% uptime guarantees, or zero-downtime protection during extreme attack events.

Threat model

Denial-of-service attacks seek to overwhelm infrastructure resources, rendering hosted applications unreachable or slow. Understanding the distinction between network-level and application-level threats helps define the scope of StrataGateway protection.

Volumetric attacks

Planned Coverage

Target: Network bandwidth & port capacity

Attempts to consume available network capacity through massive volumes of incoming traffic, flooding network interfaces and edge links.

Protocol attacks

Planned Coverage

Target: Network & transport protocols

Attempts to exhaust or abuse network and protocol-handling state tables on infrastructure, compute targets, or intermediate networking devices.

Application-layer attacks

Customer / App Layer

Target: Application logic & web servers

Targets application behavior, API endpoints, or database resources rather than raw network capacity. Requires application-level defenses.

StrataGateway DDoS Protection focuses primarily on infrastructure and network-layer resilience. It does not replace application-layer security, web application firewalls (WAF), or application-specific authentication logic.

Protection architecture

Conceptual protection architecture

Traffic destined for StrataGateway resources passes through multi-stage inspection and filtering layers before entering host interfaces.

1. Internet Traffic

Inbound traffic streams

2. Network Edge

Ingress traffic evaluation

3. Detection Layer

Anomaly & volume analysis

4. Mitigation / Filtering

Selective traffic drop

5. StrataGateway Network

Internal regional routing

6. Customer Resource

Clean traffic arrival

Protection may combine StrataGateway platform controls with capabilities available from underlying network infrastructure. The architecture will evolve as regional footprints expand.

Detection

Planned

In Development / Planned

Automated detection mechanisms monitor network traffic signals to identify anomalies suggestive of volumetric or protocol abuse.

Sudden volume shifts

Rapid deviations from historical traffic baselines.

Abnormal packet rates

Unusual packets-per-second spikes on specific IP destinations.

Protocol anomalies

Malformed IP headers or unexpected TCP/UDP flag patterns.

Destination saturation

Sustained traffic approaching interface capacity limits.

Unexpected traffic patterns

Asymmetric traffic bursts or suspicious origin clustering.

Network health signals

Degradation in edge packet processing metrics.

Exact detection algorithms, thresholds, sampling methods, and activation criteria are not finalized and will be published prior to general availability.

Mitigation workflow

Illustrative mitigation lifecycle

When anomalous network conditions trigger detection limits, the platform initiates an automated mitigation workflow to isolate and drop harmful traffic.

1. Traffic Anomaly

Traffic volume or packet characteristics exceed expected baseline bounds.

2. Detection & Validation

Automated platform monitors validate anomaly authenticity.

3. Mitigation Activation

Edge filtering rules and rate controls dynamically engage.

4. Traffic Filtering

Unwanted traffic is dropped while clean packets pass through.

5. Monitoring & Removal

Telemetry tracks attack status; rules disengage once traffic normalizes.

Mitigation behavior may differ depending on attack type, target destination, region, network architecture, and underlying infrastructure features.

Network-layer protection

StrataGateway intends to focus protection mechanisms at the network and transport layers to safeguard public IP endpoints and compute host availability.

Edge Filtering

Filters suspicious network packets at edge network ingress points before reaching internal host interfaces.

Rate Controls

Restricts packet ingestion rates during extreme traffic surges to preserve underlying interface integrity.

Planned features emphasize overall platform availability. Detailed implementation mechanics will reflect final network deployment specifications.

Protected resources

DDoS protection coverage is planned across core StrataGateway public infrastructure resources.

Resource
Protection Scope
Status
Cloud Compute
Public network exposure protection
Planned
Public IPv4
Network availability protection
Planned
Public IPv6
Network availability protection
Under Evaluation
Dedicated Servers
Dependent on future infrastructure model
Planned / Under Evaluation

Final protection scope may differ between product families, network tiers, and geographical regions.

Traffic handling

Active mitigations categorize incoming packets into distinct operational streams to maintain maximum legitimate access while suppressing attack traffic.

Legitimate Traffic

Normal operational flow

Forwarded directly to target resource interface

Suspicious Traffic

Potential minor delay during severe traffic spikes

Evaluated against edge rate controls and network validation checks

Clearly Unwanted Traffic

Prevented from reaching internal network interfaces

Filtered or dropped at edge boundaries before reaching host interface

DDoS mitigation is probabilistic and operational in nature. Aggressive filtering during severe volumetric events may occasionally affect legitimate traffic streams.

Customer configuration

StrataGateway intends to deliver automated network protection out of the box, minimizing mandatory customer configuration while planning future visibility options.

Protection Visibility

Planned

Real-time indicators showing mitigation status and protection readiness across assigned public IPs.

Event History

Planned

Historical log of detected network anomalies, mitigation start/stop times, and affected resources.

Destination Policies

Under Evaluation

Configurable sensitivity thresholds or policy profiles for specific compute workloads.

Notification Preferences

Under Evaluation

Alert routing to webhook endpoints or notification channels when mitigations trigger.

Manual policy tuning and mitigation customization are not available in current preview builds.

Monitoring and visibility

DDoS status and mitigation metrics are planned to integrate directly into the central StrataGateway monitoring console.

Illustrative Attack Event

Illustrative Event

Status

Mitigation Active

Target IPv4

203.0.113.10

Started

2026-07-28T18:30:00Z

Traffic Trend

Elevated (Volumetric)

Example address from reserved documentation range (203.0.113.0/24).

Read the monitoring documentation

Attack events

The platform will record lifecycle events throughout detected DDoS incidents to provide historical auditability.

ddos.detected

Triggered when network monitoring detects anomalous traffic patterns exceeding baseline thresholds.

ddos.mitigation_started

Triggered when automated filtering rules or edge rate controls are actively applied to incoming traffic.

ddos.mitigation_updated

Triggered when mitigation parameters or active filtering rules are dynamically adjusted.

ddos.mitigation_ended

Triggered when network conditions normalize and active mitigation filtering is removed.

Event schema names are illustrative. Raw packet captures (PCAP) and deep forensic log access are not included in planned telemetry.

API access

Planned

Illustrative Future API

DDoS protection event history and status indicators will be exposed via standard REST API endpoints.

Illustrative request

Illustrative requestcURL
curl -X GET "https://api.stratagateway.com/v1/ddos/events" \
  -H "Authorization: Bearer $STRATA_API_TOKEN"

Illustrative response

Illustrative responseJSON
{
  "id": "ddos_evt_example",
  "resource_id": "inst_7a91c2",
  "status": "mitigating",
  "category": "volumetric",
  "started_at": "2026-07-28T18:30:00Z"
}

Endpoint routes, request parameters, and response schemas are illustrative previews and are subject to change.

Read the REST API preview

Limitations

Platform Limitations & Boundaries

  • DDoS protection features are under active architecture design and development.
  • No network protection system can guarantee complete mitigation of all possible attack vectors.
  • Protection availability and capability scope may vary across compute plans and regional datacenters.
  • Aggressive filtering under extreme conditions may impact a portion of legitimate traffic.
  • Application-layer (L7) attacks require application-specific rate limits, WAF, or authentication.
  • Exact bandwidth capacity limits (Tbps/Mpps) and activation response times are not published.
  • Customer self-service rules and custom policy profiles are not currently supported.

Shared responsibility

Maintaining application availability during attack events requires shared coordination between platform network controls and customer workload security.

Security Domain
StrataGateway Role
Customer Role
Infrastructure Protection
Platform & network edge filtering controls
Application-level rate limiting & challenge rules
Network Access
Edge rate control & routing protections
Firewall rules & protocol restriction
Application Hardening
Platform availability mechanisms
Authentication, input validation & secure design
Monitoring & Alerting
High-level network event status
Application performance & endpoint health monitoring

Operational guidance

To maximize resilience, customers should combine network DDoS protection with good infrastructure security practices.

Expose only necessary public ports
Enforce strict firewall ingress policies
Avoid running unneeded public services
Monitor resource CPU and memory health
Isolate private traffic on internal subnets
Implement application-level rate limiting
Design critical services with regional redundancy
Keep operating systems and software updated

DDoS protection and firewalls

DDoS Protection and Firewalls operate at different levels to secure compute resources.

Firewall Policy

Enforces user-configured access rules (e.g., allow TCP port 443, drop port 22 except from specific IPs).

DDoS Protection

Addresses abnormal, high-volume traffic surges designed to exhaust network interface capacity.

Traffic flow order: Internet → DDoS Protection Edge → Firewall Policy → Compute Resource.
Read the firewalls documentation

DDoS protection and security

Network availability protection is one essential pillar of the broader StrataGateway platform security posture.

Comprehensive Platform Security

Authentication & IAMAccount protectionInfrastructure isolationFirewall policiesSSH key managementCredential handlingTelemetry monitoringAutomated backupsIncident responseNetwork availability protection
Read the security documentation

Provider transparency

StrataGateway may combine platform-level controls with protection capabilities provided by underlying network infrastructure and tier-1 transit partners. The protection architecture will continue to evolve as StrataGateway expands its global infrastructure footprint.

Was this page helpful?