Inside Azure's DDoS Defense | Behind the Code

How do Azure engineers distinguish a legitimate traffic surge from a distributed denial-of-service (DDoS) attack without penalizing real customers? Karthik Uthaman, principal software engineer in Microsoft's Azure Front Door group, explains how traffic patterns and system resource usage help engineers tell the difference. In this episode of Behind the Code, Karthik takes the problem to the whiteboard. He walks through resource-based defenses, finding top traffic contributors in a multi-tenant service, and combining threat intelligence with client fingerprinting to distinguish legitimate requests from malicious automated traffic. ⭐ What You'll Learn - How DDoS attacks can exhaust CPU, memory, and network resources - Why resource protection goes beyond individual attack vectors - How requests per second (RPS) correlate with CPU utilization - Why per-IP rate limiting alone cannot distinguish all good and bad traffic - How Microsoft Threat Intelligence and JA4 fingerprints provide additional signals - Why probabilistic data structures support real-time, inline analysis 👥 Speaker Karthik Uthaman - Principal Software Engineer, Microsoft Azure Front Door group ⌨️ About Behind the Code Behind the Code explores the engineering challenges and technical decisions behind Microsoft's systems, with the people who build them. ✅ Chapter Markers 00:00 – Meet Azure Front Door engineer Karthik Uthaman 00:22 – Azure Front Door and content delivery networks 00:52 – Why applications use a CDN for protection 01:44 – DDoS explained: overwhelming a service 02:46 – AI, amplification attacks, and HTTP/2 04:10 – AI and protocol vulnerability discovery 05:00 – DDoS defense through system resource protection 06:49 – Legitimate traffic surges versus DDoS attacks 07:36 – Whiteboard: correlating RPS with CPU usage 09:00 – Probabilistic data structures and top-K traffic 10:19 – Why per-IP rate limiting falls short 11:31 – Microsoft Threat Intelligence and IP groups 13:08 – Protecting real users on compromised devices 13:36 – JA4 fingerprints and client traffic profiling 14:53 – Real-time, inline DDoS analysis 16:03 – A shared defense across Microsoft teams 🔗 Resources & Links Karthik's blog: Unmasking DDoS Attacks: https://techcommunity.microsoft.com/blog/azurenetworkingblog/unmasking-ddos-attacks-part-13/4384794 Microsoft Threat Intelligence: MCCrash DDoS botnet analysis: https://www.microsoft.com/en-us/security/blog/2022/12/15/mccrash-cross-platform-ddos-botnet-targets-private-minecraft-servers/ Azure Front Door overview: https://learn.microsoft.com/en-us/azure/frontdoor/front-door-overview DDoS protection on Azure Front Door: https://learn.microsoft.com/en-us/azure/frontdoor/front-door-ddos JA4 client fingerprint matching for Azure Front Door: https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/client-fingerprint-match-condition 🔔Subscribe to Microsoft Developer Channel https://www.youtube.com/@MicrosoftDeveloper?sub_confirmation=1 #Azure #AzureFrontDoor #DDoS #CloudSecurity #MicrosoftDeveloper #BehindTheCode