How can online game companies judge that they have been attacked?

Assuming that it is true that it is not a common fault in route and hardware configuration, the connection to the server suddenly becomes more and more difficult, and the customers in the game are disconnected, it is very likely that they have been attacked by DDoS. At this stage, there are two deployment methods for the IT infrastructure construction of the game industry: one is to select cloud computing technology or hosting IDC, and the other is to pull a network dedicated line. Because of the consideration of cost, most of them choose the former one. Whether it is the front or the back connection, everything is normal. Mobile game customers can enter the server game entertainment at will. If these kinds of situations suddenly appear, we can distinguish the "attacked" situation.
(1) The in / out traffic of the server is significantly higher than usual.
(2) The CPU or running memory utilization of the server has soared unpredictably.
(3) According to the inspection of the connection of the current server, it is found that many semi closed connections or many external IP addresses create more than dozens of established connections with the service item port number of the remote server, which is the result of TCP multi connection attack.
(4) The game program fails to connect to the mobile game server or the whole login process is very slow.
(5) Customers who have played mobile games suddenly can't use or have been disconnected.