I was actually thinking about this a bit recently... are we sure it's even a DDoS and not due to higher traffic? A sudden burst of real traffic could cause issues as well. I learned this first-hand when a major site linked to one of my articles and my ~300 visit/day site got over 35k visitors within an hour, crashing it over and over in the process.