Behavior of an online system is modified dynamically using feature expressions and feature loops. A feature expression can be expressed as a combination of other features or feature expressions, thereby allowing specification of complex features. The sets of feature expressions and policies of an online system can be modified while the online system is running. Feature loops aggregate values of a feature expression across a plurality of actions, for example, number of occurrences of an event over a time interval. The online system evaluates a set of feature expressions in response to actions performed by users. Feature expressions are used to specify policies that determine how the online system reacts to certain types of user actions. The ability to dynamically modify the feature expressions and policies of the online system allows the online system to adapt to attacks by malicious users in a timely manner.