netstat -planet |grep ESTAB | grep 3306 | wc-l
Look at the connections.
Then watch zaprositi in the database
Then stick in a firewall and blokish everything except the desired port.
See logs - there is one way or another it will be seen that as a Yes.
Well, it is - blokish the database connections from a certain host. all.
If you want to play with the firewall - fail2ban - smoke this way.
Load growth is not always associated with DDoS, MB disks degraded, or somewhere that neopilina.. well this is the place to check)