Out of curiosity, who pays more -- the attacker or the victim? Purely from a monetary perspective.
Edit: never mind, figured it's obvious.
Aren't DDoS requests pretty much simple GET requests? Is it not possible to determine which requests to serve and which ones to ignore?