I'm using an EWMA class to calculate an exponentially weighted moving average. What I'm measuring is the rate at which bytes are arriving at my server for each client that sends a request. I want to refuse requests that are being transmitted too slowly. This is to mitigate the Slow HTTP Post attack.
I'm trying to figure out the optimal time interval for calculating the moving average. Not having expertise in statistics, I am assuming that a window too small will not give sufficient smoothing. On the other hand, I don't want a client tying up a connection for five minutes before my server decides it's sending data too slowly. I'm looking for the smallest effective window.
Any guidance on the window size would be much appreciated.
