The Do-No-Harm Approach to Real-Time DDoS Protection