The same way any large web service would identify a sudden increase in traffic, whether malicious or not. For the servers I manage, we end up dealing with more unintentionally out-of-control bots than we do legitimate hack or DDoS attempts.