There is no way to stop a DDoS attack, you either wait it out, get more downstream bandwidth than the attack, or change your IP address. Options 1 and 3 are the only ones you could do, option 3 you can do by putting your Hub into modem mode if it isn't already and using your own router.
The best protection against DDoS attacks is to not do anything that's likely to get you DDoS'd in the first place, don't be aggressive over voice chat, stuff like that. If you were on PC you could use a VPN to mask your IP address whilst playing online if for some reason you were a constant target of attacks, but as you're on a console you'd need a router with VPN client capabilities and those may present issues for gaming anyway.
Using a VPN does not stop an active DDoS attack as it does not change your real IP address.
Using a VPN helps prevent your connection being attacked as a proactive measure by obfuscating your real IP address, you still have the same real IP address but your outbound packets are tunnelled through the VPN so reach the destination using the IP address of the VPN exit node rather than reaching the destination from your own IP address.
Obfuscating your IP address is useless if the attacker already knows it.
It can, but assuming you're using one of the larger VPN services they should have sufficient capacity to just soak the attack. Plus unlike if your own connection is attacked if that scenario occurred you'd just need to change VPN endpoint and it'd be fine.