Incoming TOR traffic is easy to recognize because all TOR exit nodes are publicly known. That means you could search by IP of exit nodes. But this traffic is actually not really considered as TOR traffic because it already left the TOR network. It's just traffic that comes from TOR. It might not even be encrypted.
Outgoing TOR traffic is much harder, if not impossible to recognize because not all entry nodes are publicly known. You could search by IP of some entry nodes of which you know the IP, but that would not cover all TOR traffic.
I think China is the best example for recognizing/filtering outgoing TOR traffic. As far as I know, they are the only country that successfully (or at least partly successfully) blocks TOR by using protocol analysis. Because of that, TOR created special algorithms for obfuscating TOR traffic in order to get it through China's great firewall. But it's a cat and mouse game. The obfuscated traffic is also recognized and blocked after some time, and then new obfuscation algorithms are developed. That's why it's so hard to block outgoing TOR traffic.
I do not know much detail about how China's traffic analysis works. Perhaps, no one here knows for sure, but maybe someone could give a guess, although it's probably not a simple procedure.