We do have API rate limiting the number of requests per minute or second. If attacker wants to send an attack by 100's of requests and Volterra have the Rate Limiting feature it still blocks for an minute and accepts requests in the next minute. Time period to accept another bulk of requests is very short when we configure Minute and it makes no difference for second. Since window size is short he can send back to back of bulk traffic. Hence, Hourly basis of blocking the traffic is needed under this circumstances.