Newspaper Group SmartDNS and AI Security Operations

Challenge

Multiple IDCs and clouds with DNS split across carriers and cloud consoles; failover meant hand-editing records, with recovery averaging over 40 minutes. Breaking news drove 5–8× traffic spikes mixed with DDoS and scraping, and nobody could tell a genuine surge from an attack in time.

GSS scope of responsibility

GSS owned the SmartDNS platform, multi-cloud CDN scheduling integration and 24/7 operations, working with the group SOC. Traffic baselines and response policies were confirmed by the group security team.

Solution

GSS delivered an independently operated SmartDNS platform (multi-carrier / multi-IDC health checks, second-level failover) integrated with multi-CDN steering, plus AI traffic baselining, anomaly detection and bot identification wired into the group's SOC for automatic response, operated 7×24 by the GSS NOC.

Background

The group publishes 12 titles and several new-media apps, with content served from two owned IDCs, two public clouds and three CDNs. DNS lived in carrier portals and cloud consoles; when an IDC or circuit failed, engineers edited records by hand and waited for TTLs to expire — average recovery exceeded 40 minutes.

Major news events pushed traffic up 5–8×, with DDoS and large-scale scraping hidden inside the surge. Deciding from a traffic graph whether it was “a story or an attack” was slow, and both blocking real readers and letting attacks through had happened.

Solution

SmartDNS and network steering (traditional network business)

• SmartDNS platform: a three-node Anycast authoritative cluster across the two IDCs and one public cloud, running HTTP / TCP / ICMP health checks against every origin, circuit and CDN node, completing failover within 8 seconds.
• Intelligent steering by visitor carrier and region (China Telecom / Unicom / Mobile / CERNET / overseas), coordinated with the three CDNs’ origin policies for two-layer DNS + CDN steering.
• Multi-IDC interconnect: GSS supplied dedicated circuits between the IDCs and clouds plus multi-carrier BGP access as the foundation for failover.
• Visibility and audit: every record change is logged; a pre-set “major-coverage mode” policy can be switched on in one click.

AI security operations (AI business)

• Traffic baseline model trained on 18 months of DNS and CDN logs per site and time-of-day, separating genuine event-driven growth from anomalous bursts so protection is not triggered by a real story.
• Bot and scraper identification scoring query behaviour, request rate, UA and device fingerprint in real time; high-scoring IPs / ranges receive honeypot answers at the DNS layer or are rate-limited at the CDN edge.
• SOC integration: alerts and actions flow into the group’s security operations platform; major incidents are jointly staffed by the GSS NOC and the group’s security team.
• Resolution insights: audience region and carrier breakdowns per title and app version feed publishing cadence and CDN procurement decisions.

Results

Metric	Before	After
Failover time	> 40 min (manual)	8 s (automatic)
Daily DNS queries	~110M (fragmented)	260M (single platform)
Availability during major coverage	Several outages	Zero outages across 2024
Malicious traffic blocked	Manual blocking	93% automatic
False blocking of real readers	Occasional	Near zero
Mean resolution latency	~45 ms	~12 ms (Anycast)

Live since March 2024 and proven through multiple major coverage events; GSS provides ongoing managed operations and quarterly model refreshes.