Systems and methods for decentralized security against defined and undefined threats

A decentralized security system comprising:

• a plurality of security controllers providing network security for a plurality of endpoints, wherein a particular security controller of the plurality of security controllers comprises one or more hardware processors configured to:
• receive a plurality of states associated with different hashed identifiers from one or more other security controllers of the plurality of security controllers;
• receive a request from a particular client that is directed to a particular endpoint;
• generate a first hashed value from hashing an identifier from the request that identifies the particular endpoint;
• update a first state of the plurality of states based on the first hashed value matching a hashed identifier that is associated with the first state, wherein the first state is a first cumulative count representing a number of times the particular endpoint is requested across the decentralized security system, and wherein a second state of the plurality of states represents a number of requests received from the particular client across the decentralized security system;
• and
• implement a protective action in response to an updated value generated from updating the first state violating a security rule.

A non-transitory computer-readable medium storing program instructions that, when executed by one or more hardware processors, cause a particular security controller of a decentralized security system to perform operations comprising:

• receive a plurality of states associated with different hashed identifiers from a plurality of other security controllers of the decentralized security system;
• receive a request from a particular client that is directed to a particular endpoint;
• generate a first hashed value from hashing an identifier from the request that identifies the particular endpoint;
• update a first state of the plurality of states based on the first hashed value matching a hashed identifier that is associated with the first state, wherein the first state is a first cumulative count representing a number of times the particular endpoint is requested across the decentralized security system, and wherein a second state of the plurality of states represents a number of requests received from the particular client across the decentralized security system;
• and
• implement a protective action in response to an updated value generated from updating the first state violating a security rule.