I usually set a fairly high threshold that a normal user wouldn't likely reach in terms of number of requests. That stops most false-positives, but catches a good bit of the malicious requests that are trying to flood the site.