None of these options will solve your issues. Your attackers will simply re-adjust the mechanism as soon as they figure out your heuristics. You'll need to focus on two efforts:

(1) Being able to identify the IPs from which attacks originate, in real time. You will need to blacklist those hosts (for a limited period of time).

(2) Minimizing and limiting the impact of traffic you previously flagged, on your infrastructure. Ideally, as hostile traffic is flagged, a response is never sent (at the TCP/UDP level). You absolutely do not want to serve any flagged requests. Block traffic as early as possible.