The function of automatically blocking the other party's IP when being attacked by CC or DDOS

This function is used to count how many times each visitor has visited in a short period of time. If the number of visits exceeds the limit, it returns TRUE. After that, you can use PHP to call linux's iptables to perform the blocking operation. I have used several I have actually tested DDOS tools and the results are very good.
By the way, I use files in the code to record the visitor IP and time. It is best not to use a database (and don’t be clever and save it in the session) , in addition, it is best to put this file on the SSD hard drive. I won’t go into details for the reason. I think everyone knows it.

 Prevent malicious reorganization on the client side
 Usage:
 $isf5=Fun::isf5();
 Return:
 Return bool[true: the other party is maliciously reorganizing; false: normal access]
/**/
public static function isf5(){
 $_f=Run.'_isf5';
 if(!file_exists($_f)){
 file_put_contents($_f,serialize(array) ()),LOCK_EX);
 chmod($_f,0777);
 }
 $arr=unserialize(file_get_contents($_f));
 $arr=(!is_array($arr)) ? array() : $arr ;

 //Clear out users who visited 10 seconds ago
 foreach($arr as $k=>$v){
 if($_ENV['now']-$v['t'] >= 10 ){
 unset($arr[$k]);
 }
 }

 $ip='_'.(self::cur('ip'));

 if(!isset($arr[$ip ])){
 $arr[$ip]['n']=1; //The number of connections within 1s
 $arr[$ip]['t']=$_ENV['now']; // Time of the first access
 file_put_contents($_f,serialize($arr),LOCK_EX);
 chmod($_f,0777);
 unset($_f,$arr,$ip);
 return FALSE;
 }else {
 if(!isset($arr[$ip]['t']) or !is_numeric($arr[$ip]['t'])){
 unset($arr[$ip]);
 file_put_contents ($_f,serialize($arr),LOCK_EX);
 chmod($_f,0777);
 unset($_f,$arr,$ip);
 return FALSE;
 }
 if(($_ENV['now ']-$arr[$ip]['t']) <= 1){ //If the time since the last access is not more than 1s, only the number of times will be accumulated
 $arr[$ip]['n'] +=1;
 if($arr[$ip]['n']>=5){
 unset($_f,$arr,$ip);
 return TRUE;
 }else{
 file_put_contents($_f ,serialize($arr),LOCK_EX);
 chmod($_f,0777);
 unset($_f,$arr,$ip);
 return FALSE;
 }
 }else{ //If the distance from the last visit If the time has exceeded 1s, count again
 $arr[$ip]['n']=1;
 $arr[$ip]['t']=$_ENV['now'];
 file_put_contents($_f, serialize($arr),LOCK_EX);
 chmod($_f,0777);
 unset($_f,$arr,$ip);
 return FALSE;
 }
 }
 unset($_f,$arr,$ip );
 return FALSE;
}

DDOS, function