In most cases, it is very hard to mitigate DDoS attacks on your own. Most banks and large companies will engage the service of professional DDoS mitigation service providers. The latter will detect anomaly traffic patterns and reroute all traffic to their scrubbing centers for filtering out the bad traffic. The following filtering-based mechanisms are commonly used to mitigate such attacks:
1) Whitelisting recognized IP addresses. e.g., if your company is located in the US and so are most of your clients located, then it could be reasonable to filter our network traffic coming from other parts of the world during an attack so that most of your clients can still be able to access your service.
2) Blacklisting traffic coming from known "spammer" regions.
3) Deploy progressive challenge mechanism like CAPTCHA to prove that the traffic came from a human source and not some program.
4) Rate limiting by destination IP address. Each IP address is only allowed to send a fixed number of requests and the rest of the requests will be simply dropped.
5) Signature-based anomaly detection and subsequent IP blocking. Even if the malicious packets appear normal, there could still exist distinct patterns in the overall traffic. e.g., an average user will only send traffic continuously for 5 minutes each day but the traffic sent by the attacker just keep coming in for long periods of time.
And finally, increase your network resources to survive the attack or temporary rent extra cloud-based resources to "absorb" the attack. Such a counter measurement is used by DDoS Mitigation service providers like Incapsula, Akamai and Verisign to prevent themselves from becoming victims.