How do Azure engineers distinguish a legitimate traffic surge from a distributed denial-of-service (DDoS) attack without penalizing real customers? Karthik Uthaman, principal software engineer in Microsoft's Azure Front Door group, explains how traffic patterns and system resource usage help engineers tell the difference.
In this episode of Behind the Code, Karthik takes the problem to the whiteboard. He walks through resource-based defenses, finding top traffic contributors in a multi-tenant service, and combining threat intelligence with client fingerprinting to distinguish legitimate requests from malicious automated traffic.
⭐ What You'll Learn
- How DDoS attacks can exhaust CPU, memory, and network resources
- Why resource protection goes beyond individual attack vectors
- How requests per second (RPS) correlate with CPU utilization
- Why per-IP rate limiting alone cannot distinguish all good and bad traffic
- How Microsoft Threat Intelligence and JA4 fingerprints provide additional signals
- Why probabilistic data structures support real-time, inline analysis
👥 Speaker
Karthik Uthaman - Principal Software Engineer, Microsoft Azure Front Door group
⌨️ About Behind the Code
Behind the Code explores the engineering challenges and technical decisions behind Microsoft's systems, with the people who build them.
✅ Chapter Markers
00:00 – Meet Azure Front Door engineer Karthik Uthaman
00:22 – Azure Front Door and content delivery networks
00:52 – Why applications use a CDN for protection
01:44 – DDoS explained: overwhelming a service
02:46 – AI, amplification attacks, and HTTP/2
04:10 – AI and protocol vulnerability discovery
05:00 – DDoS defense through system resource protection
06:49 – Legitimate traffic surges versus DDoS attacks
07:36 – Whiteboard: correlating RPS with CPU usage
09:00 – Probabilistic data structures and top-K traffic
10:19 – Why per-IP rate limiting falls short
11:31 – Microsoft Threat Intelligence and IP groups
13:08 – Protecting real users on compromised devices
13:36 – JA4 fingerprints and client traffic profiling
14:53 – Real-time, inline DDoS analysis
16:03 – A shared defense across Microsoft teams
🔗 Resources & Links
Karthik's blog: Unmasking DDoS Attacks: https://techcommunity.microsoft.com/blog/azurenetworkingblog/unmasking-ddos-attacks-part-13/4384794
Microsoft Threat Intelligence: MCCrash DDoS botnet analysis: https://www.microsoft.com/en-us/security/blog/2022/12/15/mccrash-cross-platform-ddos-botnet-targets-private-minecraft-servers/
Azure Front Door overview: https://learn.microsoft.com/en-us/azure/frontdoor/front-door-overview
DDoS protection on Azure Front Door: https://learn.microsoft.com/en-us/azure/frontdoor/front-door-ddos
JA4 client fingerprint matching for Azure Front Door: https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/client-fingerprint-match-condition
🔔Subscribe to Microsoft Developer Channel
https://www.youtube.com/@MicrosoftDeveloper?sub_confirmation=1
#Azure #AzureFrontDoor #DDoS #CloudSecurity #MicrosoftDeveloper #BehindTheCode
In this episode of Behind the Code, Karthik takes the problem to the whiteboard. He walks through resource-based defenses, finding top traffic contributors in a multi-tenant service, and combining threat intelligence with client fingerprinting to distinguish legitimate requests from malicious automated traffic.
⭐ What You'll Learn
- How DDoS attacks can exhaust CPU, memory, and network resources
- Why resource protection goes beyond individual attack vectors
- How requests per second (RPS) correlate with CPU utilization
- Why per-IP rate limiting alone cannot distinguish all good and bad traffic
- How Microsoft Threat Intelligence and JA4 fingerprints provide additional signals
- Why probabilistic data structures support real-time, inline analysis
👥 Speaker
Karthik Uthaman - Principal Software Engineer, Microsoft Azure Front Door group
⌨️ About Behind the Code
Behind the Code explores the engineering challenges and technical decisions behind Microsoft's systems, with the people who build them.
✅ Chapter Markers
00:00 – Meet Azure Front Door engineer Karthik Uthaman
00:22 – Azure Front Door and content delivery networks
00:52 – Why applications use a CDN for protection
01:44 – DDoS explained: overwhelming a service
02:46 – AI, amplification attacks, and HTTP/2
04:10 – AI and protocol vulnerability discovery
05:00 – DDoS defense through system resource protection
06:49 – Legitimate traffic surges versus DDoS attacks
07:36 – Whiteboard: correlating RPS with CPU usage
09:00 – Probabilistic data structures and top-K traffic
10:19 – Why per-IP rate limiting falls short
11:31 – Microsoft Threat Intelligence and IP groups
13:08 – Protecting real users on compromised devices
13:36 – JA4 fingerprints and client traffic profiling
14:53 – Real-time, inline DDoS analysis
16:03 – A shared defense across Microsoft teams
🔗 Resources & Links
Karthik's blog: Unmasking DDoS Attacks: https://techcommunity.microsoft.com/blog/azurenetworkingblog/unmasking-ddos-attacks-part-13/4384794
Microsoft Threat Intelligence: MCCrash DDoS botnet analysis: https://www.microsoft.com/en-us/security/blog/2022/12/15/mccrash-cross-platform-ddos-botnet-targets-private-minecraft-servers/
Azure Front Door overview: https://learn.microsoft.com/en-us/azure/frontdoor/front-door-overview
DDoS protection on Azure Front Door: https://learn.microsoft.com/en-us/azure/frontdoor/front-door-ddos
JA4 client fingerprint matching for Azure Front Door: https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/client-fingerprint-match-condition
🔔Subscribe to Microsoft Developer Channel
https://www.youtube.com/@MicrosoftDeveloper?sub_confirmation=1
#Azure #AzureFrontDoor #DDoS #CloudSecurity #MicrosoftDeveloper #BehindTheCode