What is this for? And what do you want to do if this is detected?
Well I think based on IP first. And that of course this is the main one.
Secondly, if there are ready-made detection methods, use them. Otherwise, you need to come up with a detection method yourself. And they can be different I guess...