I would suggest that the simplest defense is probably to buy access to a CDN that provides protection against DoS. Take a look at Cloudflare and Cloudfront. You could also look at MaxCDN, Akamai, EdgeCast, level3, Rackspace, VPS, Cotendo, Limelight, Cachefly, Highwinds, and many others.
Why use a CDN? Three reasons.
First, it will benefit both performance and security. It will make your site faster. And, if you get a flash cloud or an unexpected spike of visitors, it'll help keep your site fast, responsible, and available. And, of course, if you come under DOS attack, the CDN has the capacity to absorb the traffic and ensure your site stays available. So, this is a win-win for both security and site performance. (How often do you see that?)
Second, it is affordable. A CDN is relatively inexpensive, and is almost certainly cheaper than the staff time it would take for you to futz around with defending yourself against DOS attacks and to keep up with the latest DOS techniques.
Third, the CDN can probably do a better job than you can. Because of its scale, the CDN probably sees thousands of DOS attacks a year (on hundreds or thousands of web sites), so it has a chance to accumulate statistics on the common patterns, learn how to detect DOS attacks, and work out what defenses work best. Also, because of its scale, the CDN may be able to afford for its employees to stay up-to-date on the latest attack techniques being used in the wild. And, the CDN may be able to afford to develop custom automated defenses, since they'll be applicable to all its customers.
So, take a look at CDNs as a possible defense. That may be simpler to deploy and more effective than the approach you are taking.