Well, firstly, let's define the term "DDOS". That stands for Distributed Denial Of Service, keyword being distributed. If you limit the number of connections per IP, it doesn't matter, because you have a hundred thousand different IP addresses hammering your system.
So you limit by request size. Great, how do you distinguish between some guy F5ing and a node in a botnet?
But whatever, let's say we have a magic behavioural analysing algorithm. DDoS attacks seek to exhaust server resources and ensure the machine is not reachable--throwing complex data analytics at a problem caused by resource starvation is going to exacerbate the issue, not solve it.
The unfortunate fact of the matter is, even ignoring a connection takes some resources. You could consider looking into a service like Cloudflare, which mixes caching for low resource usage per request with (I believe) human aided DDoS detection, but re-implementing this service yourself is likely out of scope for most projects and would massively increase complexity.
3How do you distinguish between legitimate traffic to a popular website, versus a DDoS? – None – 2013-10-04T22:35:17.607
If you see 100 ips with same download rate, maybe you see. Or if you have 1 ip downloading all of your internet, ........... – Marcus N – 2013-10-04T22:36:16.550
1So it depends, right? No algorithm is going to solve it without some form of intelligence. That's where people like CloudFlare come in. – None – 2013-10-04T22:37:04.020
1Can you rewrite the question? Besides being hard to understand what you are really asking, this will get a lot of opinion-based answers. – Doktoro Reichard – 2013-10-04T22:38:22.873
No, I cant write any better question; im just wondering why DDOS cant be prevented. - edit - close it if you need – Marcus N – 2013-10-04T22:39:28.670
2
I then refer you to the about page and the help page. It seems to me like a lack of respect when you didn't even bother to read what is expected of the community.
– Doktoro Reichard – 2013-10-04T22:46:13.343Keep in mind, there are more than the two types. pretty much any form of DOS attack can be made better by distribution, so application layer attacks (bad input to your app which crashes it) , internetwork layer attacks (magic packets, ack/rst/fin floods), and physical layer attacks (frag buffer overflows, offset fragment attacks, rx buffer overflows) can all be distributed, in order to increase the impact of the attack. as such, you need well coded apps, and hardened network stacks in addition to packet analysis and firewalling. to sum up, DOS is a generic name for a large family of attacks. – Frank Thomas – 2013-10-05T05:03:33.253