kickstarter/rack-attack — pull request #16 by madlep (2013-06-06 14:44:40+00:00)
Title: new `strike_out` DSL method for blocking all requests from repeatedly malicious sources

This adds a new feature to Rack::Attack - to identify malicious activity ("strikes"), against some value (e.g. IP address), and then ban that value once a certain number of strikes have been hit within a specified period.

The metaphor is like striking out in baseball - you can swing at the ball, and play the game with a few strikes, but once you get 3 strikes, you're out.

This is similar to `throttle`, but instead of just throttling requests that match some condition, this blocks ALL requests once a few have matched the condition.

We've used this technique very successfully to mitigate a penetration testing tool that had been hammering our site for days, running from hundreds of distributed IP addresses (guessing a botnet or similar). Our initial implementation used hand rolled count/blocking cache logic within a regular `blacklist` block. However the code was cumbersome, so I extracted the logic out into a new DSL method in Rack::Attack instead.

This action probably results in more overhead and cache resource than `blacklist` or `throttle` usage (as it hits the cache almost every request), however we've been handling this with ~8000rpm happily on a single memcached instance.