In the context of defense mechanisms against large-scale attacks, which layer employs distributed denial of service (DDoS) protection to prevent these attacks from causing a denial of service for users?