A DDoS attack mitigation system includes a plurality of stateless network devices connected to a network. The system also includes one or more DPI devices connected to the plurality of stateless devices. The system further includes a controller connected to the plurality of stateless devices and connected to the DPI devices. The controller includes logic integrated with and/or executable by a processor. The controller is configured to receive a signal from a first DPI device and analyze the received signal. The controller is further configured to update a network traffic policy to redirect at least some of network traffic destined for the first DPI device to one or more DPI devices different from the first DPI device based on the analyzed signal and to send a signal indicative of the updated network policy to at least some of the plurality of stateless devices.