[joosters]

You can tell the difference between the two by checking if the Evil bit is set in the corresponding IP packet - RFC 3514 already standardised this.

[Intralexical]

If that doesn't work, you can also add rate limiting by enforcing compliance with RFC 1149.