I'm currently working on a project that builds a defense system against HTTP GET Flooding attacks. When DDoS attacks occur, traffic volume to a server suddenly increases to be far more than the normal range. However, because the detection process takes time, the defense system cannot immediately mitigate the attacks. So I suppose that before the detection process finds out attacker's IP addresses, my defense mechanism needs a mechanism to randomly block flows to the server to avoid server's resource overload.
Can my randomly blocking approach be effective? Is there any other way to mitigate DDoS attacks during the detection period?