How can I prevent malicious or malfunctioning software clients from consuming resources by using minimal data to hold connections open?

Set the minimum data throughput to a rate that you expect legitimate or correctly functioning client applications to sustain. The value of the MinFileBytesPerSec metabase property enforces the minimum data throughput rate when IIS sends or receives data. If the throughput rate of a connection falls below the number of seconds specified by the MinFileBytesPerSec value, IIS terminates the connection. The default MinFileBytesPerSec value is 240. To change the value, type the following at a command prompt, where NumberOfSeconds is the minimum data throughput rate, in seconds:

cscript adsutil.vbs SET W3SVC/MinFileBytesPerSec "NumberOfSeconds"