Rate Limiting Beyond Static Thresholds
Rate limiting identifies hostile traffic by how often requests arrive. The basic version is a static threshold: block a source that sends more than X requests in Y seconds. It's simple, and it works up to a point.
Take a login page. A legitimate user usually gets in within one to three attempts. An attacker might try dozens of times in a few minutes. Count the attempts, block above a threshold, and you've stopped the simple case.
What rate limiting catches
DDoS attacks. Excessive request volume from one or many sources.
Credential stuffing. Repeated logins with stolen credentials, often spread across many sources so that no single one crosses the threshold.
Brute force. Systematic guessing of credentials.
Scraping and data theft. High-frequency access to content or data.
Inventory denial. Bots that start transactions over and over to hold stock so real buyers can't get it.
Where static thresholds fail
Static limits need careful manual configuration. Set them too low and you block legitimate users. Set them too high and attacks get through. And the right value changes: a sale or a product launch can multiply legitimate traffic, while a distributed attack can stay under every per-source limit.
Rate limiting has developed in three steps:
- Thresholds: from fixed values per URL or endpoint, to dynamic values based on historical traffic, to thresholds adjusted by ML.
- Scope: from counting per source to recognizing patterns across sources.
- Context: taking into account what the request is and what blocking it would cost the business.
What an adaptive system should do
- Learn normal traffic patterns automatically.
- Adjust thresholds by business impact, for example raising them during high-traffic events.
- Tell high-volume legitimate buyers apart from inventory-denial bots.
- Catch distributed attacks before any single source reaches a threshold.
The goal is protection that doesn't cost legitimate users their access.