Always-on DDoS mitigation