In a system attempting to detect SYN scans, one technique is to analyze the rate of change of (network packets sent from victim host per second). Processes such as uploading a large file would not be "detected" as belonging to the SYN scan because the rate of change would remain constant. But when a SYN scan is happening, the rate of change is high. I don't fully understand why it is really any higher, I get that the person scanning is sending small raw packets to multiple ports and thus the victim host is in a small instant sending back many responses.
So I guess say you are poking 200 ports simultaneously, sending say raw packets of size 20 to each port, your rate of change is 4000. How come you can't attempt to upload a file at that same rate? I guess what I don't get is why this rate of change is restricted for large files but not for many small files equaling the same size essentially.