Training a million models per day to save customers of all sizes from DDoS attacks

Cloudflare describes an automated, multivariate anomaly detection system to identify unmitigated DDoS attacks by modeling stable, volume-independent traffic features and scoring deviations using PCA- and Mahalanobis distance–based methods, avoiding pitfalls of naive volumetric or seasonal time-series approaches; it scales via Airflow on Kubernetes to retrain ~daily across representative zones, enabling rapid detection of emerging attack patterns without per-customer tuning.