There are tools which can help such as MCI's DOStracker. This could be difficult as sometimes, good logs are not created, and some crackers remove logs when they break into machines. It could be harder if court orders have to be obtained to get companies to help. If a cracker returns to the same machine, he'll be caught as the machine will be closely monitored. The signatures on several malicious daemons are detectable, so administrators can scan for them.
Many products are available.
However, some programs are open source, and attackers can change their signatures so that scanners do not detect them. - Use Akamai, a distributed service. Denial of service attacks depend on being able to find bottlenecks. Yahoo uses a centralized database which the attackers were able to exploit.