[mrcabada]

I wonder if there's any way to tell apart real-users-requests from fake-users-requests.

If I'm not wrong, it's only preventable by increasing the resources of the server, doing anti-bots things like CAPTCHAS (not feasible for stand-alone IoT devices) or detecting weird patterns (which can be masked really easily).

How will DDoS attack be preventable in the future? There will be so many things and nano-thing connected to the internet that can act as "attackers". Is getting harder and harder everyday.

[mabbo]

What software is the piece that is answering the question "is this a real user or fake?". Because that's the piece that will fall over during a DDoS, as it's doing per-request processing.