Preventing DDoS can be tricky. Of course the only play you have is to identify the malicious IPs and to have them blocked by your webhosting provider.