Wiki, you have a point. There is only one teeny-weeny problem with "blocking for the duration of an attack". How do you know when the attack has finished? When do you know you can take an IP off the black list? Behaviour-based protection takes care of that automatically.

As for you, endso, sorry, your post was waaaay too long. About 3x over the acceptable limit. So, you may have a point too but I did not bother digging through the huge haystack looking for it