Boxing the Hydra: Defending against Denial of Service attacks

Over several weeks, our online catalog was hit by millions of ISBN searches from thousands of IP addresses, with several hundred thousand requests/day at the peak of the attack. I'll talk about how we tried, failed, and ultimately succeeded in blocking this attack while minimizing the impact on our legitimate users.