The same metrics any site uses to identify bot behavior. It's a closely guarded secret because if the attackers knew what metrics they used the attackers would know how to not get caught.

Another reply pointed out that AdNauseam just makes an http request to simulate a "click" and throws away the response. A real click would load and execute the response so it's trivially easy for ad networks to detect AdNauseam "clicks".