Additionally, I' thinking of; How to detect DDoS attachs?
Here's one way I've come up that's quite simple:
> Detecting DDoS attacks by tracking requests across multiple IPs in a sliding window. If total requests exceed a threshold in a given time, flag as potential DDoS.