1. The clicker's IP address matches the one on your AdSense account.
It's a no-brainer. Don't click on your own ads.
2. Suspiciously high CTR
According to a report I read, anything above 10% will be flagged, but 6% or 7% would probably be a safer limit.
3. Clickers' IP addresses come from the same geographical area
This is for those who think they can get away with clicking on their ads from their friends' computer, their grandma's computer, and their neighbor's computer. It just ain't gonna work.
4. Cookies
Most users don't use the same IP address every time they login. That's why Google stores the IP addresses related to a particular user in a cookie. If you thought using a proxy clicker bot was gonna make you an AdSense millionnaire, don't quit your day job.
5. Short-stay pattern
Usually, visitors on your site take a few seconds to check out your content, and then maybe they'll click on your links. Google doesn't like it the other way around, i.e. if they only stay a few seconds just to click on links.
6. One-site pattern
Google compares different users' activities on different sites. It will ask: why is this user clicking on ads on site X and not on any other site?
7. Direct-access pattern
Google doesn't like it when one category of users clicks on your ads more than another. In particular, they don't like it when users who access your site directly (i.e. no referrer) click on your ads but no one else does. So much for click exchange forums.
8. Big Brother
Google doesn't just own AdSense. They also own gmail, Google earth, and a host of other applications. They WILL track your IP across these applications so don't think that just because you don't use an IP to login to AdSense you can use it to click on your ads.
9. The invisible website
If your website doesn't rank highly on Google's search engine, they may get suspicious if you get an insane amount of traffic and clicks. The traffic won't get you banned, but all those clicks better be legit.
10. Begging the click
Don't write stuff like "please visit our sponsors" on your webpage. You have to be a moron to think that Google can own a search engine and not find out about this sort of thing.
11. Conversions
I'm not sure how they verify this one, but it's obvious: if your clicks don't convert, it don't look good.