Well, firstly, let's define the term "DDOS". That stands for Distributed Denial Of Service, keyword being distributed. If you limit the number of connections per IP, it doesn't matter, because you have a hundred thousand different IP addresses hammering your system.
So you limit by request size. Great, how do you distinguish between some guy F5ing and a node in a botnet?
But whatever, let's say we have a magic behavioural analysing algorithm. DDoS attacks seek to exhaust server resources and ensure the machine is not reachable--throwing complex data analytics at a problem caused by resource starvation is going to exacerbate the issue, not solve it.
The unfortunate fact of the matter is, even ignoring a connection takes some resources. You could consider looking into a service like Cloudflare, which mixes caching for low resource usage per request with (I believe) human aided DDoS detection, but re-implementing this service yourself is likely out of scope for most projects and would massively increase complexity.