Question: What i'm wondering is, what kind of behaviour does google analytics show when a ddos attack occurs? Any theories?

Answer: 
It will show up 100% some significant peaks in google analytics , simply because there are huge number of requests from multiple sources having huge bounce rate !
It depends how the bot works, but here's what happened to my website:

[![Google Analytics real time report for the monk](https://i.stack.imgur.com/AuMWT.jpg)](https://i.stack.imgur.com/AuMWT.jpg)

Google Analytics real time report for [the monk](https://www.themonk.com.au/)

As well as the increase in traffic you will likely see your bounce rate go sky high and average time on page significantly drop - which I'm sure can have a negative impact on SERPS.

For me it coincided with a Google update so first I put it down to that, but I started getting a lot of traffic to the root page, terms, and privacy, with many prefixed with /?m=0 which is in itself odd (and I'd love for someone to shed light).

The attack caused a great deal of timeouts and was painful to fix:

In short, I hooked up [CloudFlare](https://www.cloudflare.com/), then created Security -> WAF rules to challenge countries where I was receiving most of the bot traffic. I also switched on the basic bot attack mode (there's a more effective super bot attack mode with the paid subscriptions).

The other interesting point of note was why was my site subject to a DDOS attack. I wish I knew, but at a similar time to when the attack started I was approached by someone who enquired about buying the website. Possibly a tactic to get me to sell it/sell it cheap.