[tor-relays] Attacks to and from Tor

Hi everybody, I've read a few threads about attacks from exit nodes to the clear net and from the clear net to tor nodes and have several questions: -How can you recognize that the attacks to tor nodes are especially against Tor? -And how can a clear net user or better IDS easily differencing between an attacker that comes over Tor (exit node) or from a clear net host? I think this is important to categorize the situation. Thanks, Tom