Defending Against DDoS and Layer 7 Credential Stuffing: RSHIELD WAF Architecture

Automated adversary swarms frequently target authentication endpoints and public APIs using distributed residential proxies. Preventing service outages requires sub-millisecond threat classification before requests ever hit upstream application layers.

1. Understanding Layer 7 Application Floods

Unlike Layer 4 volumetric attacks (SYN floods, UDP reflection) that saturate network pipe bandwidth, Layer 7 attacks mimic legitimate HTTP requests. An attacker flooding an expensive search endpoint or AI inference route can paralyze CPU and database connection pools with only 500 requests per second.

2. Redis Sliding Window Rate Limiting

Fixed-window rate limiters suffer from boundary burst vulnerabilities, allowing up to double the permitted requests around window resets. A sliding-window log using Redis sorted sets (ZSET) provides mathematically continuous rate enforcement:

import time
import redis.asyncio as aioredis

async def check_sliding_window_rate_limit(
    redis: aioredis.Redis,
    client_ip: str,
    max_requests: int = 60,
    window_seconds: int = 60
) -> bool:
    key = f"rate_limit:{client_ip}"
    now = time.time()
    cutoff = now - window_seconds

    pipe = redis.pipeline()
    # Remove old entries outside the active window
    pipe.zremrangebyscore(key, 0, cutoff)
    # Add current timestamp score
    pipe.zadd(key, {str(now): now})
    # Count requests in window
    pipe.zcard(key)
    # Set TTL on key to prevent unbounded growth
    pipe.expire(key, window_seconds + 5)

    results = await pipe.execute()
    current_count = results[2]

    return current_count <= max_requests