Selective rate limiting via a hybrid local and remote architecture

A system comprising:

• a plurality of agent devices collocated with different nodes of a distributed platform at which different services, content, or data of the distributed platform may be accessed, wherein at least one agent device of the plurality of agent devices comprises one or more processors that are configured to:
• receive a packet from a client device;
• inspect the packet using a plurality of rules, wherein each rule of the plurality of rules comprises at least one different (i) rule definition with traffic dimensions identifying a different attack, (ii) signal with which to differentiate attack traffic with the traffic dimensions of a specific attack from other traffic, (iii) threshold specifying a condition, and (iv) action to implement based on the condition of the threshold being satisfied;
• and
• provide a particular signal to the packet in response to the packet matching the traffic dimensions from the rule definition of a particular rule from the plurality of rules, and wherein the particular rule differentiates the attack traffic of a particular attack with the particular signal;
• a controller device that is located remote from the plurality of agent devices, wherein the controller device comprises one or more processors that are configured to:
• update a value in response to the at least one agent device providing the particular signal to the packet, wherein the value tracks a number of times the particular signal is provided to packets associated with a client identifier of the client device;
• and
• implement the action of the particular rule across the plurality of agent devices in response to the value being associated with the particular signal, the particular signal being associated with the particular rule, the particular rule being defined with the threshold, and the value satisfying the condition for the threshold of the particular rule.

A non-transitory computer-readable medium, storing a plurality of processor-executable instructions to:

• receive a packet from a client device;
• inspect the packet using a plurality of rules, wherein each rule of the plurality of rules comprises at least one different (i) rule definition with traffic dimensions identifying a different attack, (ii) signal with which to differentiate attack traffic with the traffic dimensions of a specific attack from other traffic, (iii) threshold specifying a condition, and (iv) action to implement based on the condition of the threshold being satisfied;
• provide a particular signal to the packet in response to the packet matching the traffic dimensions from the rule definition of a particular rule from the plurality of rules, and wherein the particular rule differentiates the attack traffic of a particular attack with the particular signal;
• update a value in response to providing the particular signal to the packet, wherein the value tracks a number of times the particular signal is provided to packets associated with a client identifier of the client device;
• and
• implement the action of the particular rule in response to the value being associated with the particular signal, the particular signal being associated with the particular rule, the particular rule being defined with the threshold, and the value satisfying the condition for the threshold of the particular rule.