Hundreds of Gbps of UDP traffic to random ports of a single destination IP from residental (?) network should be pretty easy pattern to automatically detect and throttle.
More advanced attacks are more tricky to detect, but plain dumb UDP flood should be easily detectable.
Have you ever uploaded 100's of Gbps over QUIC from your residential connection to a single IP?
And the aggregate across the ISP's network could in theory be monitored - so if you were uploading 1Gbps, yes, it could be legitimate. If you and 582 others were all uploading 1Gbps to the same IP at the same time, much less likely legitimate.
I.e. no traffic beyond my legitimate saturation can reach the ISP
I have saturated my link with quic or wireguard (logical or) plenty of times.
The lack of any response on high data rates would be an indicator
I've only tried that once and it failed gloriously due to congestion.
I don't think there's many real protocols that are unidirectional without even ACKs
My point is that you don't have 100's of Gbps of bandwidth on a residential connection. In the future you might, but in the future it'll be 10's or 100's of Tbps for a large DDoS, or something.
More advanced attacks are more tricky to detect, but plain dumb UDP flood should be easily detectable.