You probably mean to include DDoS attacks (Distributed Denial of Service) rather than DoS attacks which could technically be a single packet (think Ping of Death).
None the less the criteria you are asking about is slightly different from provider to provider but a few things which are easily tracked by these devices are the following:
1.) Seeing systems suddenly generate large bursts of traffic, above 10,000 packet per second is a good rule of thumb.
2.) Seeing large numbers of packets leaving a customers network with falsified source IP addresses. In theory this would be blocked by egress rules but it does happen.
3.) Large amounts of intentionally malicious traffic. SYN Flood attacks, UDP Flood attacks, DNS Amplification attacks, Bulk SNMP requests sent from a "target" host.
4.) Large amounts of intentionally fragmented packets.
Cisco, a large commercial routing manufacturer, has a document which may also give you more insight into what can be detected.
Wikipedia has a really useful entry on Denial of Service Attacks that also mentions a lot of the network traffic you will want to look for.
Finally the following paper may also be useful