API Ratelimit Simulation
A JavaFX desktop simulation that models how modern cloud platforms and API gateways internally monitor traffic, enforce rate limits, and block abusive clients in real time.
Status
Completed
Technologies
3
Overview
Smart API Rate-Limit & Abuse Simulator is an interactive JavaFX desktop application designed to model the internal protection and traffic-metering mechanisms of modern API Gateways. The system operates entirely in-memory using pure Java objects and the Java Time API, eliminating the need for real networks, servers, or external databases. Traffic can be ingested through three distinct modes: manual interactive form submission, high-velocity synthetic burst generation, or batch loading from CSV/TXT datasets. At its core, a pluggable rule engine uses the Strategy Pattern to execute multiple rate-limiting algorithms, including Fixed Window, Sliding Window, Burst Detection, Abnormal Pattern, and Retry Abuse policies. Incoming requests are dynamically evaluated in real time, where conforming calls are permitted and threshold breaches are rejected with instant quota feedback. Clients exhibiting malicious or excessive activity are categorized into granular severity tiers (`NORMAL`, `WARNING`, `CRITICAL`, `BLOCKED`) under a monotonic escalation rule. The user interface features a reactive dashboard equipped with live metric cards, an audit activity table, system event logs, and dynamic traffic distribution charts. Finally, it provides comprehensive per-client abuse diagnosis reports, offering full transparency into violation history, quota consumption, and actionable mitigation recommendations.
46
Java Classes
5
Rate & Abuse Policies
< 1ms
Decision Latency
4
Ingestion Mode
Key Features
- Multi-mode traffic ingestion (Manual, Burst generator, and CSV/TXT datasets)
- Pluggable rate-limiting algorithms (Fixed Window and Sliding Window)
- Smart abuse detection (Burst spikes, Retry abuse, and Abnormal patterns)
- Automated violation classification and client blocking (NORMAL to BLOCKED)
- Real-time visual dashboard with live KPI metrics, charts, and activity logs
- Detailed per-client abuse diagnosis and audit report generation
Technology Stack
Styling & UI
CSSLanguage
Java
JavaFXScreenshots
Timeline
Project Planning & Architecture
Defined domain models, layered system architecture, and strategy-based policy contracts.
Core Engine & Policy Implementation
Implemented Fixed Window, Sliding Window, burst detection, and anomaly evaluation rules.
Traffic Ingestion & Tracking Services
Built manual request forms, synthetic burst generators, CSV dataset loaders, and client trackers.
UI & Dashboard Development
Designed the JavaFX desktop interface with live KPI cards, traffic charts, tables, and event logs.
buse Reporting & Verification
Developed per-client diagnostic reporting, mitigation recommendations, and automated JUnit test suites.
Challenges
- High-frequency rolling timestamp evaluation and sliding-window calculation in memory
- Maintaining smooth JavaFX UI responsiveness during high-velocity burst traffic
- Designing an extensible, decoupled policy engine supporting runtime algorithm swapping
- Thread-safe in-memory state management and defensive data encapsulation
- Distinguishing legitimate traffic spikes from malicious retry and burst abuse patterns
Solutions
- Using Java Time API (LocalDateTime, Duration) and timestamp-filtered collections for precise rolling windows
- Batching burst request executions to keep the JavaFX UI Application Thread non-blocking and smooth
- Implementing the Strategy Design Pattern (RatePolicy) for hot-swappable rate-limiting algorithms
- Applying defensive encapsulation with unmodifiable collections for safe in-memory state isolation
- Combining specialized anomaly policies with monotonic severity escalation (NORMAL to BLOCKED)