Inside Azure's DDoS Defense | Behind the Code
Karthik Uthaman, principal software engineer in Microsoft’s Azure Front Door group, takes the engineering problem to the whiteboard. The discussion follows how a shared content delivery service can identify harmful traffic while keeping legitimate requests flowing.
Resource protection and traffic analysis
Distributed denial-of-service (DDoS) attacks overwhelm a service by exhausting resources such as CPU, memory, and network capacity. Uthaman discusses resource-based defenses that go beyond individual attack vectors, alongside amplification attacks, HTTP/2, and AI’s role in protocol vulnerability discovery.
The whiteboard examples examine the relationship between requests per second (RPS) and CPU utilization, then turn to finding the top traffic contributors in a multi-tenant service. Probabilistic data structures support top-K traffic analysis and real-time, inline processing.
Distinguishing malicious traffic from real users
Per-IP rate limiting alone cannot distinguish all legitimate traffic from malicious automated requests. The discussion introduces additional signals:
- Microsoft Threat Intelligence, including information about IP groups.
- JA4 client fingerprints, used to profile client traffic.
- Traffic patterns and resource usage, which help assess the effect requests have on the service.
Protecting real users on compromised devices is part of the challenge: identifying suspicious traffic must not automatically mean penalizing every legitimate request from the same device. The episode closes with a look at shared defense efforts across Microsoft teams.
Video chapters
- 00:00 — Meet Azure Front Door engineer Karthik Uthaman
- 00:22 — Azure Front Door and content delivery networks
- 00:52 — Why applications use a CDN for protection
- 01:44 — DDoS explained: overwhelming a service
- 02:46 — AI, amplification attacks, and HTTP/2
- 04:10 — AI and protocol vulnerability discovery
- 05:00 — DDoS defense through system resource protection
- 06:49 — Legitimate traffic surges versus DDoS attacks
- 07:36 — Whiteboard: correlating RPS with CPU usage
- 09:00 — Probabilistic data structures and top-K traffic
- 10:19 — Why per-IP rate limiting falls short
- 11:31 — Microsoft Threat Intelligence and IP groups
- 13:08 — Protecting real users on compromised devices
- 13:36 — JA4 fingerprints and client traffic profiling
- 14:53 — Real-time, inline DDoS analysis
- 16:03 — A shared defense across Microsoft teams