Do you have models for traffic pattern differences between spikes and DDoS attacks? It seems that a DDoS attack would have different patterns (quicker spike, no buildup, etc.). Just speculation here.
Even if you could identify malicious usage, it's still a matter of policy on how you want to respond to it - given that if it can reach your VM it will likely be affecting legitimate traffic too.