The only real mitigation approach that makes sense against a lot of these attacks is to dam them at the sting or Main network or maybe at the provider now. That’s nice that you simply define that OpenVZ vendors may perhaps use much less strong servers than KVM, it’s something to grasp