Do you use a root server or a virtual server?
RSD always used a root server, and we had ddos attacks too, but none of them actually did a full crash on the server.
Edit: What just came to my mind: When someone is crashing the server via ddos, he probably wants to see the result and reactions of players, so he probably is connected to the server during the attack. Maybe you can look and find out who it is with this?