Final filtering
Thursday, February 24, 2011
12:13 PM
Now our schema is:
user2: (user:chararray, locations:{(subnet:chararray)})
A bot attack is a lot of failed attempts from many different locations. First, quantify "a lot".
lots = FILTER user2 by COUNT(locations)>1000;
Then quantify how many locations: 
user3 = FOREACH user2 {
places = DISTINCT locations; 
GENERATE user, COUNT(places) as places;
}
user4 = FILTER user3 by places>100;
Tell the administrator that these users are under attack by bots:
DUMP user4; 