Before filtering is implemented, it makes sense for ISPs to warn their customers that their hardware was involved in a ddos attack. Analyzing historical data is

Before filtering is implemented, it makes sense for ISPs to warn their customers that their hardware was involved in a ddos attack. Analyzing historical data is typically much easier than real-time.