[tor-relays] Attacks to and from Tor

Hi everybody,

I've read a few threads about attacks from exit nodes to the clear net and from the clear net to tor nodes and have several questions:

-How can you recognize that the attacks to tor nodes are especially against Tor?

-And how can a clear net user or better IDS easily differencing between an attacker that comes over Tor (exit node) or from a clear net host?

I think this is important to categorize the situation.

Thanks,

Tom