How to monitor abnormal usage in DynamoDB

You can enable logging of DynamoDB data plane events in CloudTrail

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/logging-using-cloudtrail.html

and check PutItem events https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_PutItem.html

Preferred Option

Since you see a spike in DynamoDB usage, but you aren't sure on which table I assume you are seeing the spike in AWS Cost Explorer. If that's the case you can enable resource level granularity by opting in to it. This will provide historic metrics for the previous 14 days.

Allow all accounts to access hourly and resource-level information for the past 14 days. Resource-level information is only available for your Amazon EC2 service usage. Please note that it can take up to 24 hours for your data to become available, and a cost of $0.01 per 1,000 UsageRecords-month will be incurred as a result of storing and accessing your hourly- and resource-level information. A UsageRecord is defined as one line of usage. For example, one EC2 instance running for 24 hours will generate 24 distinct UsageRecords at the hourly granularity.

Alternative Option

Enable Cloudtrail Dataplane Logs which incurs a higher cost than the other option and also does not show any history. One benefit is that it can tell you exactly where the requests came from, down to the role being used and the IP address that sent it.