Have a connection broker on another IP address that you authenticate against prior to getting connection details for the real system. Rotate the IP addresses the real system uses every couple of days. Let brokered connections live for 48 hours so the DDOS attack has to last that long to do anything. If the real system gets attacked, drop that IP and pick up a new one, noting what users received that IP address as they are potentially the attacker.

Not perfect but it would probably stop these kids.