You look for trends, not raw numbers. If an ip increase 500%in 10 minutes... throttle it a bit... insert wait times. If it's trust worthy then allow new value to become normal... otherwise keep the ip throttled.