There are different types of DDOS attacks.  An easy example is the SYN Flood attack. In this attack, the attacker sends a TCP connection request (a packet with the SYN flag set). The server allocates resources for the connection and responds. The attacker ignores the response, and the server must keep the resources allocated until a time out occurs. If there are enough requests over a period of time, the server runs out of resources.

If the server is a public server (say for an e-commerce site), it has to expect connection requests from any computer in the world.

A smart attack will spoof the source IP addresses. Therefore the IDS will not know that this is an attack instead of just a lot of normal traffic. If the system attempts to reduce the number of connections by rejecting some requests, it may reject legitimate requests.

An attacker can use a botnet to distribute the sources around the world to prevent techniques that look at a large number of requests from a single portion of the internet. Such mechanisms can be placed in gateway routers.

Another type of attack is a SYN reflection attack. The attacker spoofs an IP address and sends an request to a server (say a web server). The server responds to the spoofed IP address with a SYN/ACK message. The spoofed address is the victim machine and it must process all of the responses as if they were initial requests from the senders.

To summarize: The successful attacks look like legitimate requests from a range of machines and can not be easily differentiated from normal traffic.

Adding to @Jims answer,  DDoS is very dynamic behavior. Signatures are more static in nature. Difficult to encapsulate dynamic behavior of network in static signatures.  

I would not completely agree with the statement that DDoS attacks cannot be detected with signature based detection mechanisms but then again we need to think of the issues associated with such mechanisms. In signature based detection mechanism, we are basically trying to create a profile or a signature associated with a particular kind of attack which is saved in our database for matching when we encounter an attack. However, the number of types of DDoS attacks are increasing day by day starting with the typical TCP flooding, UDP flooding, ICMP flooding, SYN flooding and certain source based and destination based bandwidth and scanning attacks. With the evolution of new next generation networks, new next generation attacks are also evolving which are quite hybrid in nature and difficult to catch when we try to match them against some previously set signature profiles. Besides, it becomes an even bigger challenge when we consider distinguishing DDoS attacks from legitimate large volumes of traffic which we term as Flash Crowds. Now the main solution remains in creating the right profiles based on deep anomaly analysis which has a necessity to be real time and also which is capable of evolving just as our evolving attack types. 

@Nishat , yes if you consider those profiles as signatures then you are right. I was coming more from a Snort world. Where signatures are well defined packet patterns matched via regular expressions. Thanks for clarification

signature based is fixed and has limited resource of knowledge, the DDOS is dynamic and there is always something new .