How can I differentiate between a legitimate traffic spike and an OCN DDoS attack?

Differentiating can be challenging. Look for patterns: sudden, massive increases in traffic from numerous, geographically diverse sources, unusual request types or patterns, and a significant drop in website performance for legitimate users. CDN monitoring tools and anomaly detection systems can help identify these patterns and alert administrators.