Detecting DDOS Tools
Most current intrusion detection systems notice the current generation of tools.
They work by looking for DDOS control messages.
Naturally, these will change over time; in particular, more such messages will be properly encrypted. (A hacker PKI?)