DDoS protection strategies in HLD - Scalability & System Analysis

Scalability Analysis - DDoS protection strategies

Growth Table: DDoS Protection at Different Scales

Users/Traffic	Impact on System	Protection Needs	Typical Solutions
100 users	Normal traffic, no DDoS risk	Basic firewall and rate limiting	Simple IP filtering, basic rate limiting
10,000 users	Higher traffic, occasional spikes	Enhanced rate limiting, anomaly detection	Web Application Firewall (WAF), IP reputation checks
1 million users	High traffic, potential for large DDoS attacks	Distributed mitigation, traffic scrubbing	CDN with DDoS protection, traffic filtering, geo-blocking
100 million users	Massive traffic, frequent large-scale attacks	Global distributed defense, automated mitigation	Multi-layered defense, Anycast networks, cloud-based DDoS protection services

First Bottleneck: Network Bandwidth and Application Servers

At small scale, the system handles traffic normally. As traffic grows, the network bandwidth becomes the first bottleneck because DDoS attacks flood the network with excessive requests.

Application servers also become overwhelmed by processing fake requests, leading to CPU and memory exhaustion.

Without protection, the system becomes unreachable due to network saturation or server overload.

Scaling Solutions for DDoS Protection

• Rate Limiting: Limit requests per IP to reduce flood impact.
• Web Application Firewall (WAF): Filter malicious traffic based on patterns.
• Content Delivery Network (CDN): Distribute traffic globally to absorb attacks.
• Traffic Scrubbing Centers: Redirect traffic through cleaning services to remove malicious packets.
• Anycast Network: Use multiple data centers with the same IP to distribute attack traffic.
• IP Reputation and Geo-blocking: Block traffic from suspicious or high-risk regions.
• Autoscaling: Dynamically add servers to handle traffic spikes.
• Monitoring and Alerting: Detect attacks early and respond quickly.

Back-of-Envelope Cost Analysis

• At 1 million users, assuming 1 request per second per user -> 1 million RPS.
• Single server handles ~5,000 RPS -> need ~200 servers for application layer.
• Network bandwidth: 1 million RPS x 1 KB/request = ~1 GB/s (~8 Gbps).
• Requires multiple 10 Gbps network links and distributed data centers.
• CDN and scrubbing services add cost but reduce load on origin servers.
• Monitoring and mitigation tools require additional compute and storage.

Interview Tip: Structuring DDoS Protection Discussion

Start by explaining what DDoS attacks are and why they impact network and servers.

Discuss scaling challenges at different traffic levels.

Identify the first bottleneck (network bandwidth and server CPU).

Propose layered solutions: rate limiting, WAF, CDN, scrubbing.

Explain trade-offs and cost implications.

Conclude with monitoring and automated response importance.

Self-Check Question

Your database handles 1000 QPS. Traffic grows 10x due to a DDoS attack. What do you do first?

Answer: Implement network-level filtering and rate limiting to block malicious traffic before it reaches the database. Use a CDN or scrubbing service to absorb and filter attack traffic, preventing overload on the database.

Key Result

DDoS attacks first overwhelm network bandwidth and application servers; layered defenses like rate limiting, WAF, CDN, and traffic scrubbing are essential to scale protection effectively.

Practice

1. Which of the following is a primary goal of DDoS protection strategies?

easy

A. Keep the service available during attack

B. Increase the number of incoming requests

C. Slow down legitimate user traffic

D. Disable firewalls to allow all traffic

Solution

1. Step 1: Understand the purpose of DDoS protection

   DDoS protection aims to prevent attacks from making a service unavailable by handling malicious traffic.

2. Step 2: Evaluate each option against this purpose

   Increasing requests or slowing legitimate traffic harms availability. Disabling firewalls reduces security. Only keeping service available matches the goal.

3. Final Answer:

   Keep the service available during attack -> Option A

4. Quick Check:

   DDoS protection = Keep service available [OK]

Hint: DDoS protection means keeping service up, not blocking all traffic [OK]

Common Mistakes:

• Confusing DDoS protection with traffic blocking
• Thinking DDoS protection increases traffic
• Assuming firewalls should be disabled during attacks

2. Which component is commonly used to distribute incoming traffic and help mitigate DDoS attacks?

easy

A. Load balancer

B. Cache server

C. Database server

D. Application server

Solution

1. Step 1: Identify components that manage traffic

   Load balancers distribute incoming requests across multiple servers to prevent overload.

2. Step 2: Match component to DDoS mitigation role

   Load balancers help absorb and spread traffic, reducing attack impact. Other options do not distribute traffic.

3. Final Answer:

   Load balancer -> Option A

4. Quick Check:

   Traffic distribution = Load balancer [OK]

Hint: Load balancers spread traffic to avoid overload [OK]

Common Mistakes:

• Confusing cache or database servers as traffic distributors
• Thinking application servers handle traffic distribution
• Ignoring the role of load balancers in DDoS defense

3. Consider a system using a CDN and a firewall with rate limiting. Which of the following best describes the request flow during a DDoS attack?

medium

A. Requests go directly to the origin server, bypassing CDN and firewall

B. CDN absorbs traffic, firewall filters requests, then origin server processes allowed requests

C. Firewall blocks all requests, CDN caches nothing

D. Origin server handles all requests before CDN and firewall

Solution

1. Step 1: Understand CDN and firewall roles

   CDNs cache content and absorb traffic near users. Firewalls filter malicious requests before reaching origin.

2. Step 2: Trace request flow during attack

   Requests first hit CDN, which reduces load. Firewall then filters suspicious traffic. Only allowed requests reach origin server.

3. Final Answer:

   CDN absorbs traffic, firewall filters requests, then origin server processes allowed requests -> Option B

4. Quick Check:

   Request flow = CDN -> Firewall -> Origin [OK]

Hint: Traffic flows CDN -> Firewall -> Origin server during attack [OK]

Common Mistakes:

• Assuming requests bypass CDN or firewall
• Thinking firewall blocks all requests indiscriminately
• Believing origin server handles all traffic first

4. A system uses IP blacklisting to block attackers, but legitimate users are still affected. What is the likely issue?

medium

A. Firewall is disabled

B. Blacklist is empty, no IPs blocked

C. Blacklist is too broad, blocking shared IPs

D. System does not log blocked IPs

Solution

1. Step 1: Analyze impact of IP blacklisting

   Blacklisting blocks specific IPs. If too broad, it may block IPs shared by many users.

2. Step 2: Identify why legitimate users are affected

   Blocking shared IPs causes collateral damage to good users. Other options do not explain this effect.

3. Final Answer:

   Blacklist is too broad, blocking shared IPs -> Option C

4. Quick Check:

   Legitimate users blocked = Broad blacklist [OK]

Hint: Too broad blacklist blocks good users too [OK]

Common Mistakes:

• Assuming empty blacklist blocks users
• Ignoring shared IP usage in blacklisting
• Thinking firewall status causes this issue

5. You design a DDoS protection system combining CDN, rate limiting, and real-time traffic analysis. Which approach best balances user experience and attack mitigation?

hard

A. Apply strict rate limits globally, blocking many users during spikes

B. Allow all traffic and rely on origin server capacity

C. Disable CDN and rely only on manual IP blocking

D. Use CDN to absorb traffic, apply adaptive rate limits based on analysis, and alert admins on anomalies

Solution

1. Step 1: Evaluate each strategy's impact on users and attack defense

   Strict global limits block many users, hurting experience. Disabling CDN or manual blocking is slow and risky.

2. Step 2: Identify balanced approach

   Using CDN to absorb traffic reduces load. Adaptive rate limits adjust to traffic patterns, minimizing false blocks. Real-time alerts enable quick response.

3. Final Answer:

   Use CDN to absorb traffic, apply adaptive rate limits based on analysis, and alert admins on anomalies -> Option D

4. Quick Check:

   Balanced DDoS defense = CDN + adaptive limits + alerts [OK]

Hint: Combine CDN, adaptive limits, and alerts for best balance [OK]

Common Mistakes:

• Applying strict limits without adaptation
• Ignoring CDN benefits
• Relying only on manual blocking or server capacity