Abstract: Embodiments are directed towards detecting and thwarting incoming network requests by either throttling and/or redirecting the attack requests towards a honeypot. As network requests are received, TCP segments are examined to identify a presence of attack signatures before returning an ACK. Such attack signatures may identified based on an absence of referrer headers, an invalid cookie, known improper sender addresses, known valid sender addresses, examination of OSI layer 4 and/or above content of a packet, or the like. If an attack is identified, throttling may be employed by responding to the attack requests by dropping and/or rejecting packets within the request, acknowledging the client device's packets at a byte level, modifying a round trip time (RTT) calculation by responding at a defined slowed rate, and/or redirecting client requests to a honeypot.

Abstract: A method, system, and apparatus are directed towards managing content over a network. A request from a requestor for a resource is received over the network. The request may include a request for resource identified by a Network Resource Identifier (NRI). The request may also include Systems Interconnection (OSI) level 2-7 data. Characteristics of the requestor are determined based on the request. The characteristics are mapped onto a label. A unique key is generated based on the request, the characteristics, and/or the label. A version of the resource to cache is determined based on the request, the characteristics, the label, and/or the unique key. The version of the resource is cached based on the unique key.