It also assumes malicious request have same or similar signature attributes (ex: IP addr, http hdrs), which is not always the case.