sleep() costs my servers resources. Using it to delay response to the attacker might cost him/her time, but allows for DOS. Is it possible to keep him/her waiting without costs of mine?
Assuming I can tell (or at least very well estimate) that data send to my via POST method is an attack.
First in a fit of anger I though I would be smart, just never answering the request and leave the attacker "waiting forever", therefore I thought I would use sleep(30).
Then I found out that this opens the door for the attacker (especially when using DDos that is more than 1 IP) to drive my server load through the roof because each "dangling" (i.e. sleeping) script costs me resources on my system.
Is there a way know way to delay a response at very little costs? (i.e. breaking of the TCP/IP connection without notice and keep attack in the dark/waiting)
Alternatively: In essence is there maybe even a strategy to reverse the resource costs?