When a web site is attacked, so far by unsuccessful hackers, my error routine adds the attackers IP address, prefixed by 'deny', to that web site's .htaccess file. It works and the attacker, on second and subsequent attacks, gets a 403 error response.
Have you looked at mod_evasive? http://www.zdziarski.com/blog/?page_id=442
Barry