Selective rate limiting via a hybrid local and remote architecture

1. A method comprising:

receiving a packet from a client device;

inspecting the packet using a plurality of rules, wherein each rule of the plurality of rules comprises at least one different (i) rule definition with traffic dimensions identifying a different attack, (ii) signal with which to differentiate attack traffic with the traffic dimensions of a specific attack from other traffic, (iii) threshold specifying a condition, and (iv) action to implement based on the condition of the threshold being satisfied;

providing a particular signal to the packet in response to the packet matching the traffic dimensions from the rule definition of a particular rule from the plurality of rules, and wherein the particular rule differentiates the attack traffic of a particular attack with the particular signal;

updating a value in response to providing the particular signal to the packet, wherein the value tracks a number of times the particular signal is provided to packets associated with a client identifier of the client device; and

implementing the action of the particular rule in response to the value being associated with the particular signal, the particular signal being associated with the particular rule, the particular rule being defined with the threshold, and the value satisfying the condition for the threshold of the particular rule.

2. The method of claim 1 ,

wherein inspecting the packet comprises comparing one or more of a header, Uniform Resource Locator (“URL”), metadata, and message body of the packet against the traffic dimensions from the rule definition of the plurality of rules at an agent that is collocated with a node that is an intended recipient of the packet, and

wherein the traffic dimensions comprise at least one specific value for a specific field of the header, a specific parameter or query string argument of the URL, a metadata key-value pair, or specific data in the message body.

3. The method of claim 2 ,

wherein providing the particular signal comprises passing the particular signal and the client identifier from the agent to a controller that is remote from the agent and the node; and

wherein implementing the action comprises providing the action from the controller to the agent in response to the controller determining that the value, that is linked to the particular signal and the client identifier satisfies the condition for the threshold of the particular rule.

4. The method of claim 1 further comprising:

receiving a second packet and a third packet from the client device;

blocking the second packet from a node that is an intended recipient of the second packet in response to implementing the action against the second packet and the second packet being provided with the particular signal as a result of the second packet matching the traffic dimensions from the rule definition of the particular rule; and

issuing the third packet to the node in response to the third packet not being subject to the action as a result of the third packet not containing the traffic dimensions from the rule definition of the particular rule.

5. The method of claim 1 ,

wherein receiving the packet comprises receiving the packet at a first agent of a plurality of agents, wherein each agent of the plurality of agents provides attack protections for a different node of a plurality of nodes forming a distributed platform;

wherein implementing the action comprises configuring each agent of the plurality of agents with a blocking action that prevents any packet with the client identifier from reaching an intended node of the plurality of nodes; and

blocking a second packet that is issued by the client device and that arrives at a second agent of the plurality of agents before reaching a node of the plurality of nodes in response to configuring the plurality of agents.

6. The method of claim 5 ,

wherein the second packet omits the particular signal as a result of the second packet not containing the traffic dimensions from the rule definition of the particular rule.

7. The method of claim 1 ,

wherein the value corresponds to a request rate at which the client device issues a plurality of packets that match the traffic dimensions from the rule definition of the particular rule, and wherein the plurality of packets are distributed across a plurality of agents that protect a plurality of nodes of a distributed platform from attack.

8. The method of claim 1 further comprising:

inspecting a response that is issued by a server in response to the packet from the client device; and

wherein providing the particular signal comprises:

providing a first signal in response to the packet matching a first set of traffic dimensions from the rule definition of the particular rule; and

providing a different second signal in response to the response matching a second set of traffic dimensions from the rule definition of the particular rule.

9. The method of claim 1 further comprising:

receiving a second packet from a different second client device;

providing a second signal and a third signal to the second packet in response to the second packet matching the traffic dimensions from the rule definition of a second rule from the plurality of rules, and wherein the second signal and the third signal are different than the particular signal, the second rule is different than the particular rule, and the rule definition of the second rule is different than the rule definition of the particular rule;

updating a second value that is linked to the second signal, the third signal, and a second client identifier of the second client device; and

implementing a second action of the second rule in response to the second value satisfying the condition for the threshold of the second rule, wherein the second action is different than the action of the particular rule.

10. The method of claim 1 further comprising:

issuing the packet to a node identified as an intended recipient of the packet while the action is inactive in response to the value not satisfying the condition for the threshold of the particular rule.

11. The method of claim 1 ,

wherein implementing the action comprises restricting the action to one of:

packets identified with the particular signal and having the client identifier;

all packets that are sent and have the client identifier;

all packets identified with the particular signal and any client identifier; and

packets identified with at least a second signal that is different than the particular signal.

12. The method of claim 1 further comprising:

deactivating the action after an expiration value specified by the particular rule is reached.

13. The method of claim 1 ,

wherein providing the particular signal comprises adding the particular signal to one of the packet header, URL, or metadata.

14. The method of claim 1 , wherein providing the particular signal comprises:

inserting the particular signal as a new header value of the packet or a new parameter of the packet URL.

15. The method of claim 1 further comprising:

providing a graphical user interface with interactive controls used to configure the rule definition, signal, threshold, and action of a new rule; and

adding the new rule to the plurality of rules.

16. The method of claim 1 ,

wherein implementing the action comprises providing one or more client identifiers for client devices subject to the action, and one or more signals identifying specific traffic from the client devices that is subject to the action.

17. A system comprising:

a plurality of agent devices collocated with different nodes of a distributed platform at which different services, content, or data of the distributed platform may be accessed, wherein at least one agent device of the plurality of agent devices comprises one or more processors that are configured to:

receive a packet from a client device;

inspect the packet using a plurality of rules, wherein each rule of the plurality of rules comprises at least one different (i) rule definition with traffic dimensions identifying a different attack, (ii) signal with which to differentiate attack traffic with the traffic dimensions of a specific attack from other traffic, (iii) threshold specifying a condition, and (iv) action to implement based on the condition of the threshold being satisfied; and

provide a particular signal to the packet in response to the packet matching the traffic dimensions from the rule definition of a particular rule from the plurality of rules, and wherein the particular rule differentiates the attack traffic of a particular attack with the particular signal;

a controller device that is located remote from the plurality of agent devices, wherein the controller device comprises one or more processors that are configured to:

update a value in response to the at least one agent device providing the particular signal to the packet, wherein the value tracks a number of times the particular signal is provided to packets associated with a client identifier of the client device; and

implement the action of the particular rule across the plurality of agent devices in response to the value being associated with the particular signal, the particular signal being associated with the particular rule, the particular rule being defined with the threshold, and the value satisfying the condition for the threshold of the particular rule.

18. The system of claim 17 ,

wherein the at least one agent device corresponds to a first agent device of the plurality of agent devices; and

wherein a second agent device of the plurality of agent devices comprises one or more processors that are configured to:

block a second packet that is issued by the client device and that arrives at the second agent device before reaching a node of the distributed platform in response to implementing the action.

19. The system of claim 17 ,

wherein the one or more processors of the at least one agent device are further configured to:

block a second packet that arrives at the at least one agent device before reaching a node of the distributed platform in response to implementing the action and the second packet being identified with at least one of the client identifier and the particular signal; and

issue a third packet that arrives at the at least one agent device to the node in response to implementing the action and the third packet being identified with a second client identifier and zero or more signals that are different than the client identifier and the particular signal.

20. A non-transitory computer-readable medium, storing a plurality of processor-executable instructions to:

receive a packet from a client device;

inspect the packet using a plurality of rules, wherein each rule of the plurality of rules comprises at least one different (i) rule definition with traffic dimensions identifying a different attack, (ii) signal with which to differentiate attack traffic with the traffic dimensions of a specific attack from other traffic, (iii) threshold specifying a condition, and (iv) action to implement based on the condition of the threshold being satisfied;

provide a particular signal to the packet in response to the packet matching the traffic dimensions from the rule definition of a particular rule from the plurality of rules, and wherein the particular rule differentiates the attack traffic of a particular attack with the particular signal;

update a value in response to providing the particular signal to the packet, wherein the value tracks a number of times the particular signal is provided to packets associated with a client identifier of the client device; and

implement the action of the particular rule in response to the value being associated with the particular signal, the particular signal being associated with the particular rule, the particular rule being defined with the threshold, and the value satisfying the condition for the threshold of the particular rule.