I have a web hosting that does not allow to edit iptables. From to time I have light (about 300 requests/sec) DoS attacks (usually not distributed). I decided to write a PHP script that will block those ips. First I tried to store all requests for last 10 secs in database and look up abusing addresses for every request. But I quickly realized that this way I have to do at least 1 request to database for every DoS request, and it's not good. Then I optimized this approach as follows:
Read 'deny.txt' with blocked ip's If it contains request ip, then die() --- at this point we have filtered out all known attacking ips --- store requesting ip in database clean all requests older than 10 secs count requests from this ip, if it is greater than threshold, add it to 'deny.txt'
This way, new attacking ip will make only
Threshold requests to database and then gets blocked.
So, the question is, does this approach have optimal performance? Is there a better way to do this task?