{"id":1881957,"date":"2026-09-19T09:15:40","date_gmt":"2026-09-19T07:15:40","guid":{"rendered":"https:\/\/blog.wedos.com\/?p=1881957"},"modified":"2026-09-19T09:15:44","modified_gmt":"2026-09-19T07:15:44","slug":"ze-zakulisi-wedos-global-protection-co-obnasi-vyvoj-evropskeho-stitu-proti-ddos-utokum","status":"publish","type":"post","link":"https:\/\/blog.wedos.com\/cs\/ze-zakulisi-wedos-global-protection-co-obnasi-vyvoj-evropskeho-stitu-proti-ddos-utokum","title":{"rendered":"Ze z\u00e1kulis\u00ed WEDOS Global Protection: co obn\u00e1\u0161\u00ed v\u00fdvoj evropsk\u00e9ho \u0161t\u00edtu proti DDoS \u00fatok\u016fm"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">V\u011bt\u0161ina na\u0161ich z\u00e1kazn\u00edk\u016f ani netu\u0161\u00ed \u017ee maj\u00ed zapnut\u00fd WEDOS Global Protection. Vid\u00ed jen klidn\u011b sp\u00edc\u00ed web, kter\u00fd \u00fatoky ani nezaregistruje. P\u0159itom je\u0161t\u011b p\u00e1r hodin p\u0159edt\u00edm to byl probl\u00e9mov\u00fd web, kter\u00fd p\u0159et\u011b\u017eoval server a ohro\u017eoval dal\u0161\u00ed z\u00e1kazn\u00edky. Podpora b\u011bhem p\u011bti minut p\u0159esm\u011brovala provoz ze serveru na v\u00edce jak stovku anycastov\u00fdch reverzn\u00edch proxy, kter\u00e9 okam\u017eit\u011b za\u010dali filtrovat provoz. Co se skr\u00fdv\u00e1 pod kapotou? Technicky je toho pod povrchem p\u0159ekvapiv\u011b dost. Poj\u010fme se na to pod\u00edvat detailn\u011bji.<\/p>\n\n\n\n<!--more-->\n\n\n\n<h2 class=\"wp-block-heading\">Architektura: dv\u011b platformy, sedm vrstev<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ochrana b\u011b\u017e\u00ed na dvou nez\u00e1visl\u00fdch, funk\u010dn\u011b identick\u00fdch platform\u00e1ch. Ka\u017ed\u00e1 na odli\u0161en\u00e9m hardware.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Uvnit\u0159 ka\u017ed\u00e9 platformy je provoz zpracov\u00e1v\u00e1n v sedmi vrstv\u00e1ch  od vstupn\u00ed L4 vrstvy, p\u0159es load balancing a cache (Varnish), a\u017e po v\u00fdstupn\u00ed vrstvu sm\u011brem k origin serveru z\u00e1kazn\u00edka. \u0160est z nich b\u011b\u017e\u00ed na HAProxy, sedm\u00e1 je pr\u00e1v\u011b ta cache. Ka\u017ed\u00e1 vrstva m\u00e1 t\u0159i samostatn\u00e9 konfigura\u010dn\u00ed profily podle typu provozu:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>vip \u2014 vyhrazena pro enterprise z\u00e1kazn\u00edk<\/li>\n\n\n\n<li>general \u2014 b\u011b\u017en\u00fd provoz<\/li>\n\n\n\n<li>attack \u2014 profil aktivovan\u00fd p\u0159i detekovan\u00e9m \u00fatoku, s p\u0159\u00edsn\u011bj\u0161\u00edmi pravidly<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Pr\u00e1v\u011b proto je konfigurace HAProxy tak rozs\u00e1hl\u00e1, nap\u0159\u00ed\u010d ob\u011bma platformami, \u0161esti HAProxy vrstvami a t\u0159emi profily se se\u010dte na zhruba 140 tis\u00edc \u0159\u00e1dk\u016f konfigurace. D\u016fle\u017eit\u00e9 je ale v\u011bd\u011bt, \u017ee to nejsou statis\u00edce jedine\u010dn\u00fdch rozhodnut\u00ed: profil attack z velk\u00e9 \u010d\u00e1sti d\u011bd\u00ed z\u00e1klad z general a li\u0161\u00ed se jen v konkr\u00e9tn\u00edch limitech a akc\u00edch. Re\u00e1ln\u00e1 &#8222;unik\u00e1tn\u00ed&#8220; rozhodovac\u00ed logika je tak v\u00fdrazn\u011b men\u0161\u00ed, ne\u017e by se dalo z po\u010dtu \u0159\u00e1dk\u016f usuzovat. HAProxy config je ale nutn\u011b explicitn\u00ed a opakovan\u00fd, proto\u017ee ka\u017ed\u00e1 vrstva a profil mus\u00ed b\u00fdt nez\u00e1visle auditovateln\u00fd a nez\u00e1visle m\u011bniteln\u00fd bez rizika, \u017ee se rozbije zbytek syst\u00e9mu.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Mozek syst\u00e9mu: Lua moduly<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Samotn\u00fd HAProxy um\u00ed sm\u011brovat a filtrovat provoz podle pravidel, ale rozhodovac\u00ed logiku, tedy &#8222;je tohle \u00fatok, nebo ne?&#8220; mu dod\u00e1v\u00e1 sada vlastn\u00edch modul\u016f napsan\u00fdch v Lua. Jde o v\u00edc ne\u017e 9 tis\u00edc \u0159\u00e1dk\u016f k\u00f3du rozd\u011blen\u00fdch do specializovan\u00fdch \u010d\u00e1st\u00ed, nap\u0159\u00edklad:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>dns_reader.lua (p\u0159es 4 000 \u0159\u00e1dk\u016f) \u2014 asynchronn\u00ed DNS klient a cache, kter\u00fd pr\u016fb\u011b\u017en\u011b na\u010d\u00edt\u00e1 konfigura\u010dn\u00ed pravidla ulo\u017een\u00e1 v DNS TXT z\u00e1znamech a \u0159e\u0161\u00ed p\u0159eklad origin\u016f jednotliv\u00fdch dom\u00e9n.<\/li>\n\n\n\n<li>log_logic.lua (p\u0159es 2 500 \u0159\u00e1dk\u016f) \u2014 normalizuje a vyhodnocuje logy z cel\u00e9 infrastruktury v re\u00e1ln\u00e9m \u010dase, co\u017e je z\u00e1klad pro rozhodov\u00e1n\u00ed, ne jen pro zp\u011btnou anal\u00fdzu.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Zbyl\u00e9 moduly se staraj\u00ed nap\u0159\u00edklad o JA4 fingerprinting (rozpozn\u00e1v\u00e1n\u00ed klient\u016f podle otisku TLS handshake, mnohem odoln\u011bj\u0161\u00ed metoda ne\u017e klasick\u00e9 User-Agent hlavi\u010dky), o klasifikaci CMS (\u010d\u00e1st pravidel je na m\u00edru), klasifikaci robot\u016f tedy odli\u0161en\u00ed legitimn\u00edch crawler\u016f a dal\u0161\u00ed moduly postupn\u011b p\u0159ib\u00fdvaj\u00ed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Tahle vrstva se dopl\u0148uje o Varnish\/AVC konfiguraci (p\u0159es 9 tis\u00edc \u0159\u00e1dk\u016f YAML mezi ob\u011bma platformami) pro cachov\u00e1n\u00ed a dal\u0161\u00ed zpracov\u00e1n\u00ed na aplika\u010dn\u00ed \u00farovni.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Data, kter\u00e1 &#8222;krm\u00ed&#8220; syst\u00e9m<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Rozhodovac\u00ed logika je jen tak dobr\u00e1, jak aktu\u00e1ln\u00ed jsou data, se kter\u00fdmi pracuje. WEDOS Global Protection udr\u017euje p\u0159es 100 MB \u017eiv\u011b aktualizovan\u00fdch seznam\u016f jako IP rozsahy, ASN mapov\u00e1n\u00ed, geoloka\u010dn\u00ed data, JA4 otisky a DNS mapy a to ve v\u00edce ne\u017e 220 souborech. Tyto seznamy se z velk\u00e9 \u010d\u00e1sti stahuj\u00ed a aktualizuj\u00ed automatizovan\u011b, nejde tedy o ru\u010dn\u011b psan\u00e1 data, ale o produk\u010dn\u00ed vstup, kter\u00fd se mus\u00ed neust\u00e1le synchronizovat s re\u00e1ln\u00fdm internetov\u00fdm provozem. K tomu se p\u0159id\u00e1vaj\u00ed regexov\u00e9 seznamy pro rozpozn\u00e1v\u00e1n\u00ed vzor\u016f v po\u017eadavc\u00edch a p\u0159es 270 \u0161ablon chybov\u00fdch\/challenge str\u00e1nek, kter\u00e9 se zobraz\u00ed, kdy\u017e syst\u00e9m provoz vyhodnot\u00ed jako podez\u0159el\u00fd.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Administrace: jedna aplikace, 34 tis\u00edc \u0159\u00e1dk\u016f<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Nad celou infrastrukturou stoj\u00ed nov\u00e1 administr\u00e1torsk\u00e1 aplikace, kterou u\u017e brzy nasad\u00edme. Jde technicky o jeden HTML+JS soubor o v\u00edce ne\u017e 34 tis\u00edc\u00edch \u0159\u00e1dc\u00edch, pln\u011b \u010diteln\u00fd zdrojov\u00fd k\u00f3d (\u017e\u00e1dn\u00fd minifikovan\u00fd build).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Kdo na tom pracuje a pro\u010d je to citliv\u00e9<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WEDOS Global Protection je bezpe\u010dnostn\u00ed infrastruktura, a k tomu se v\u00e1\u017ee logick\u00fd princip: samotn\u00fd zdrojov\u00fd k\u00f3d a j\u00e1dro rozhodovac\u00ed logiky m\u00e1 v ruce jen \u00fazk\u00e1 skupina lid\u00ed. Nen\u00ed to ot\u00e1zka d\u016fv\u011bry, ale principu. \u010c\u00edm v\u00edc lid\u00ed zn\u00e1 p\u0159esn\u00e9 detaily toho, jak syst\u00e9m rozpozn\u00e1v\u00e1 \u00fatoky, t\u00edm sn\u00e1z by \u0161lo tuhle znalost zneu\u017e\u00edt k jejich obejit\u00ed. Bezpe\u010dnostn\u00ed syst\u00e9my se dlouhodob\u011b stav\u00ed na tom, \u017ee citliv\u00e1 logika je izolovan\u00e1 od \u0161irok\u00e9ho okruhu lid\u00ed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Na druhou stranu se na v\u00fdvoji re\u00e1ln\u011b pod\u00edl\u00ed mnohem \u0161ir\u0161\u00ed skupina lid\u00ed, ne\u017e jen ti, kdo commituj\u00ed do repozit\u00e1\u0159e. Testuje se, pos\u00edlaj\u00ed se poznatky a hotov\u00e9 kusy konfigurace zven\u010d\u00ed, kter\u00e9 se pak integruj\u00ed do produk\u010dn\u00edho nastaven\u00ed, a\u0165 jde o n\u00e1vrhy nov\u00fdch pravidel, lad\u011bn\u00ed prahov\u00fdch hodnot podle konkr\u00e9tn\u00edch incident\u016f, nebo zp\u011btnou vazbu z provozu. Tenhle model &#8211; \u00fazk\u00e9 j\u00e1dro se zdrojov\u00fdm k\u00f3dem, \u0161ir\u0161\u00ed okruh spolupr\u00e1ce a testov\u00e1n\u00ed, je p\u0159esn\u011b to, co bezpe\u010dnostn\u00ed infrastruktura tohoto typu vy\u017eaduje.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">WEDOS Global Protection je na rozd\u00edl od VEDOS Hostingu daleko zn\u00e1m\u011bj\u0161\u00ed v zahrani\u010d\u00ed, kde m\u00e1me \u0159adu velk\u00fdch a v\u00fdznamn\u00fdch partner\u016f. I od nich dost\u00e1v\u00e1me zp\u011btnou vazbu, kterou n\u00e1sledn\u011b p\u00e1rujeme s logy a cel\u00fd syst\u00e9m vylep\u0161ujeme.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Co si z toho odn\u00e9st<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WEDOS Global Protection nen\u00ed jednor\u00e1zov\u00fd produkt, kter\u00fd se &#8222;ud\u011blal a je hotovo&#8220; je to \u017eiv\u00fd syst\u00e9m, kter\u00fd se t\u00fdden co t\u00fdden dola\u010fuje podle nov\u00fdch typ\u016f \u00fatok\u016f a chov\u00e1n\u00ed internetov\u00e9ho provozu. Za jednoduch\u00fdm p\u0159ep\u00edna\u010dem v administraci stoj\u00ed des\u00edtky tis\u00edc \u0159\u00e1dk\u016f vlastn\u00ed logiky, stovky tis\u00edc \u0159\u00e1dk\u016f konfigurace rozd\u011blen\u00e9 do vrstev a profil\u016f, a neust\u00e1l\u00fd p\u0159\u00edsun aktu\u00e1ln\u00edch dat o hrozb\u00e1ch z cel\u00e9ho internetu to v\u0161e chr\u00e1n\u011bn\u00e9 omezen\u00fdm p\u0159\u00edstupem k samotn\u00e9mu srdci syst\u00e9mu. Samotn\u00e1 hardwarov\u00e1 \u010d\u00e1st, konektivita jsou pak dal\u0161\u00ed slo\u017eit\u00e1 \u010d\u00e1st.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>V\u011bt\u0161ina na\u0161ich z\u00e1kazn\u00edk\u016f ani netu\u0161\u00ed \u017ee maj\u00ed zapnut\u00fd WEDOS Global Protection. Vid\u00ed jen klidn\u011b sp\u00edc\u00ed web, kter\u00fd \u00fatoky ani nezaregistruje. P\u0159itom je\u0161t\u011b p\u00e1r hodin p\u0159edt\u00edm to byl probl\u00e9mov\u00fd web, kter\u00fd p\u0159et\u011b\u017eoval server a ohro\u017eoval dal\u0161\u00ed z\u00e1kazn\u00edky. Podpora b\u011bhem p\u011bti minut p\u0159esm\u011brovala provoz ze serveru na v\u00edce jak stovku anycastov\u00fdch reverzn\u00edch proxy, kter\u00e9 okam\u017eit\u011b za\u010dali filtrovat &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/blog.wedos.com\/cs\/ze-zakulisi-wedos-global-protection-co-obnasi-vyvoj-evropskeho-stitu-proti-ddos-utokum\" class=\"more-link\">Pokra\u010dovat ve \u010dten\u00ed<span class=\"screen-reader-text\"> &#8222;Ze z\u00e1kulis\u00ed WEDOS Global Protection: co obn\u00e1\u0161\u00ed v\u00fdvoj evropsk\u00e9ho \u0161t\u00edtu proti DDoS \u00fatok\u016fm&#8220;<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":510692,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[608,600,602,203,43,615,605,613,599,611,607,205,612,552,609,601,556,604,603,610,200,606,177,597],"class_list":["post-1881957","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technologie","tag-asn","tag-automatizace","tag-bot-protection","tag-cdn","tag-ddos-ochrana","tag-ddos-utoky","tag-dns","tag-filtrovani-provozu","tag-fingerprinting","tag-geolokace","tag-haproxy","tag-infrastruktura","tag-ja4","tag-kyberneticka-bezpecnost","tag-monitoring","tag-ochrana-serveru","tag-ochrana-webu","tag-reverzni-proxy","tag-sitova-bezpecnost","tag-varnish","tag-waf","tag-webova-bezpecnost","tag-wedos-global-protection","tag-wgp"],"_links":{"self":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts\/1881957","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/comments?post=1881957"}],"version-history":[{"count":3,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts\/1881957\/revisions"}],"predecessor-version":[{"id":1885125,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts\/1881957\/revisions\/1885125"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/media\/510692"}],"wp:attachment":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/media?parent=1881957"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/categories?post=1881957"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/tags?post=1881957"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}