Question: What i'm wondering is, what kind of behaviour does google analytics show when a ddos attack occurs? Any theories?

Answer: 
My theory would be that an effective DDoS platform/script would *not* include anything as heavyweight as a JavaScript engine, and that therefore the DDoS activity would not show up in Google Analytics at all. 

The point of a DDoS attack is to overwhelm the server with a flood of requests. Any CPU cycles that are spent evaluating JavaScript in the response that the server sends back are cycles that could better be used churning out more requests to the server. I would fully expect a properly executed DDoS attack to not waste time parsing the response from the server, or even reading it off of the underlying socket, let alone interpreting and executing and JavaScript that may be embedded in the markup or fetching scripts and other resources from domains other than the target server. 

Of course, this does not preclude the possibility of an exceptionally naive DDoS attack implemented using web frameworks and libraries that *do* evaluate embedded JavaScript. Such an attack would not (or rather, *should not* if you've implemented your server code correctly) be very effective, but it would likely generate a spike in Google Analytics traffic.
It depends how the bot works, but here's what happened to my website:

[![Google Analytics real time report for the monk](https://i.stack.imgur.com/AuMWT.jpg)](https://i.stack.imgur.com/AuMWT.jpg)

Google Analytics real time report for [the monk](https://www.themonk.com.au/)

As well as the increase in traffic you will likely see your bounce rate go sky high and average time on page significantly drop - which I'm sure can have a negative impact on SERPS.

For me it coincided with a Google update so first I put it down to that, but I started getting a lot of traffic to the root page, terms, and privacy, with many prefixed with /?m=0 which is in itself odd (and I'd love for someone to shed light).

The attack caused a great deal of timeouts and was painful to fix:

In short, I hooked up [CloudFlare](https://www.cloudflare.com/), then created Security -> WAF rules to challenge countries where I was receiving most of the bot traffic. I also switched on the basic bot attack mode (there's a more effective super bot attack mode with the paid subscriptions).

The other interesting point of note was why was my site subject to a DDOS attack. I wish I knew, but at a similar time to when the attack started I was approached by someone who enquired about buying the website. Possibly a tactic to get me to sell it/sell it cheap.