There are basically two different approaches to classify DDoS attacks using the ISO/OSI network model.
1) The first of those is mostly popular in research papers: try to parse the payload of the packets the victim is receiving, as if it were legitimate traffic. The topmost (in terms of OSI model) protocol which is still recognizable defines the layerness of the attack.
Say, you're operating on a gigabit link and are receiving 3 gigabits of UDP flood per second, which renders your Internet-facing services unreachable for the rest of the world due to heavy congestion. With this approach, if the source or destination UDP port within the attack packets equals 53 and contents of those packets resemble DNS queries, then you can say it's a "DNS flood". Domain Name System belongs to the OSI layer 7, so this is a layer 7 DDoS attack.
But if suddenly the UDP port value is changed to, say, 0, then it immediately becomes a layer 4 DDoS attack ("UDP flood"), though the ultimate effect of the attack stays the same.
With this approach, virtually any attack where packets contain any sensible value in the IPv4 Protocol/IPv6 Next Header field but don't allow for any further fingerprinting would be a layer 4 attack.
2) The other approach, which is mostly used by DDoS mitigation vendors, , , is as follows. The purpose of a DDoS attack is to bring a network resource down. A network resource doesn't provide a service if, and only if, at least one of the network layers it depends on doesn't work properly. An attack "belongs" to the lowest layer which gets affected.
This way, in the example above, both DNS flood and UDP flood would be marked with either OSI layer 2 or layer 3, depending on the architecture of your network (e.g. whether the likes of
arp packet-priority enable are configured on your switches, and so on), and any attack which affects layer 4 implementations (e.g. TCP drivers and kernel modules) directly would be a layer 4 attack. Common examples include:
and so on.