OBTW, this is a pretty good article about defending against DOS/DDOS attacks:
Protecting against DDOS attacks
The author recommends you keep a current backup on AWS EC2/EBS (for example) and run it when you are a victim of an attack.
The reason is that it is too expensive to run full time on EC2 against a massive attack, but you can run it there to frustrate the attacker (and keep your customers happy), and maybe they will go away (and you can return to your cheaper configuration).
Cheers.