In the modern threat landscape, volumetric DDoS attacks (flooding a network with raw UDP traffic) are relatively easy to mitigate using standard perimeter edge defenses. However, Layer 7 (Application Layer) DDoS attacks are exponentially more dangerous. These attacks involve massive, globally distributed botnets executing mathematically legitimate, fully encrypted HTTPS requests against your web application (e.g., executing millions of complex database search queries or API POST requests). Because the traffic appears identical to legitimate user behavior, standard firewalls cannot drop it without blocking real customers, inevitably leading to database exhaustion and application downtime. To combat this, Google engineers leverage Cloud Armor Adaptive Protection, an advanced machine-learning defense system that autonomously identifies and mitigates Layer 7 attacks in real-time across the global edge network.
The Architecture of Adaptive Protection
Cloud Armor sits at the extreme edge of the Google Cloud Platform (GCP) network, terminating HTTPS connections before they ever reach your Virtual Private Cloud (VPC) or Kubernetes clusters.
When Adaptive Protection is enabled on a Cloud Armor security policy, it does not rely on static IP blacklists or rigid rate-limiting thresholds (which attackers easily bypass). Instead, the system spends the first several days building a highly sophisticated machine-learning baseline of your application’s normal traffic patterns. It models dozens of HTTP attributes, including geographic distribution, user-agent strings, HTTP headers, request URIs, and inter-request timing.
When an anomalous spike in traffic occurs, Adaptive Protection instantly compares the incoming HTTP requests against the established baseline. If it detects a signature that deviates from normality (for example, a sudden influx of POST requests from a specific ASN using an unusual combination of HTTP headers), the system autonomously generates a highly specific WAF (Web Application Firewall) rule designed to mathematically block the attack traffic while allowing legitimate customer traffic to pass unimpeded.
Enabling Cloud Armor Adaptive Protection
To deploy this capability, your application must be fronted by a Google Cloud External HTTP(S) Load Balancer, and you must possess the Cloud Armor Enterprise (formerly Managed Protection Plus) billing tier.
First, you must create a new Cloud Armor security policy and explicitly enable the Adaptive Protection engine.
# Create the base security policy
gcloud compute security-policies create prod-waf-policy \
--description="Primary WAF policy with Adaptive Protection"
# Enable the Adaptive Protection machine-learning engine
gcloud beta compute security-policies update prod-waf-policy \
--enable-layer7-ddos-defenseOnce enabled, you must attach this security policy to the backend service of your Global Load Balancer.
gcloud compute backend-services update prod-backend-service \
--security-policy=prod-waf-policy \
--globalConfiguring Autonomous Mitigation
By default, when Adaptive Protection detects a Layer 7 attack, it generates an alert in Cloud Logging and suggests a WAF rule, but it does not automatically block the traffic. This “alert-only” mode prevents accidental false positives during the initial learning phase.
However, for true Zero Trust automation, you must configure the system to autonomously deploy the generated rule. You do this by adding a specific rule to your security policy that evaluates the machine-learning confidence score.
gcloud beta compute security-policies rules create 1000 \
--security-policy=prod-waf-policy \
--expression="evaluateAdaptiveProtection('0.8')" \
--action=deny-403 \
--description="Autonomously block Layer 7 attacks with high confidence"This command instructs Cloud Armor to continuously evaluate incoming traffic. If the Adaptive Protection engine detects an attack and generates a signature with a confidence score of 0.8 (80%) or higher, Cloud Armor will instantaneously drop the malicious packets at the Google edge, returning an HTTP 403 Forbidden response to the botnet.
Monitoring the ML Telemetry
When an attack occurs, the telemetry is immediately pushed to the Google Cloud Security Command Center (SCC) and Cloud Logging.
The JSON log payload is highly detailed. It will explicitly define the exact attack signature the machine learning algorithm generated. For example, the log might reveal that the botnet was identified because 98% of the malicious requests contained an identical, forged Accept-Language header combined with a specific query parameter. By deploying Cloud Armor Adaptive Protection, security teams transition from reactive, manual firewall administration to an autonomous, AI-driven defense posture that mitigates application-layer attacks before human engineers are even paged.