First approach to DoS attack detection: There are techniques for intrusion detection, and of course DoS attack, in which for each packet (or flow) some features are calculated, then based on some classification algorithm, it is determined whether this flow is anomaly or not. This way specific flow is flagged as anomalous.
Second approach: For DoS attack, there is this technique in which network traffic is aggregated according to some features (e.g. SYN flag set) and then using signal processing or other techniques like simple threshold, they find out if there is any anomaly in this time slot or not. However, this way we can't determine which flow is anomalous. There are techniques that further process that time slot, to find anomalous flow or if anomaly is DoS (maybe by implementing the first approach for this specific time slot).
The first approach is not implemented in Snort, as I asked previously here. I don't know whether commercial products use this approach or not.
Did I understand the trends right? Why is the second approach interesting at all, if the first approach works (Or is it simply because the first approach doesn't work?). To limit the search space to a specific time slot? Is there any deference here between IDS/Firewall? Are there any other approaches?