I have the websocket server as a gen_server process which could be tied into an existing supervisor. Each connected client is an Erlang process a non gen-server one primarily because restarting a failed client is almost useless since the n/w connection cannot be reconnected. For flood prevention i use a simple concurrent connection counter and limit the max concurrent connections.