It's pretty easy to filter out the randomness using statistics. As I understand it, the correct thing to do is to derive a sleep time from hashing the request

It's pretty easy to filter out the randomness using statistics. As I understand it, the correct thing to do is to derive a sleep time from hashing the request content, along with some secret. This makes the delay "random" from the attackers point of view, but still deterministic and therefore impossible to filter out. Note: I am not a security person, just an interested bystander. Take this half-remembered advice with a pinch of salt.