Question: What i'm wondering is, what kind of behaviour does google analytics show when a ddos attack occurs? Any theories?

Answer: 
It will show up 100% some significant peaks in google analytics , simply because there are huge number of requests from multiple sources having huge bounce rate !
Well, I'm also searching this kind of information, but I have some considerations about the answer:

You will probably not see the attack itself with Google analytics, but you should see the results, I mean, a DDoS is a "distributed deny of service", so, if the service is effectively denied, then you should see a flat line on the graph on Google analytics.