On Fri, 06 Apr 2012 20:48:44 -0500, Jimmy Hess said:
That's kind of vague to say it's "unlikely to see 1 abuser". What is the probability that more IPs in the same /24 are likely to harbor abusers, given that you have received abuse from one IP?
It's similar to pirhanas or cockroaches - they can't be found everywhere, but if you spot one in a location, there's a near certainty that there's plent more in the area. Or if you don't like that, you can run a simple Monte Carlo simulation. Assume 256 customer slots, and that initially, there is a 3% chance that the next customer to arrive is evil. Also add a feedback - each time you terminate an evil customer in less than the average arrival time, the chance the next customer is evil is cut by 10% of the current value. Each time an evil customer is allowed to last 3 times the average arrival time, the chance of an evil customer goes up 10%. Simulate for various termination times for evil customers. Are there any steady-state solutions where the *average* number of evil users is one? Or does it decay down towards zero or upwards towards a high number?