Beyond on-demand for DDoS defence