To reduce noise, transition from raw count thresholds to a composite alert that requires both a 4xx surge and a high IP concentration ratio. Legitimate traffic spikes typically show a broad distribution of unique IPs, whereas DDoS attacks often concentrate millions of requests into a narrow range of addresses.