SketchProxy Uses Fixed-Memory Sketches to Block API Cardinality Attacks at the Edge

A new edge reverse proxy called SketchProxy tackles high-cardinality denial-of-service attacks that can overwhelm traditional rate-limiting systems. Conventional approaches rely on centralized Redis or Memcached clusters, which can crash or fail open when flooded with millions of ephemeral IP addresses. SketchProxy, built on Go's standard library, replaces external cache dependencies with fixed-size in-memory epoch sketch tables allocated once at startup, keeping memory consumption constant regardless of attacker scale. The design addresses three key weaknesses of distributed counter clusters: memory exhaustion, network round-trip latency of 2–10ms per request, and connection pool saturation. By maintaining strict memory bounds internally, SketchProxy aims to enforce rate limits on legitimate repeat clients while surviving IP-rotation floods without an external database.