But when you're streaming media, aren't you receiving many?
Streaming media is slightly different to your usual TCP connection in that typically you stream media over UDP. The reason for this is that the cost of building in sequence verification real time into streaming media is, while not prohibitive, potentially enough to interrupt the stream.
UDP, on the other hand, is a "blast and forget" protocol. You send the current segment of the media a number of times and hope the other end received it. If it didn't, the other end is responsible for finding a suitable way to handle that missing information - error correction at the codec level is a possibility.
... determines the ratio of TCP packets to total packets that are being sent to a "malicious host". How would this portion be able to determine whether the (would be victim) host is seeding a torrent, or if they were being SYN scanned by an attacker?
I know very little about the bittorrent protocol, however, I think you're general point that the two might be indistinguishable is probably right. According to what I have read, bittorrent uses a number of small tcp connections to transmit data. If the syn scan is limited to a small range and the bittorrent seeding to a large range I expect it might be difficult to statistically differentiate the two.
However, there are some possibilities. Firstly, the valid ports range for a bittorrent seed is likely to not involve reserved ports which might be used by other services. As a result of this, it is also likely to use a narrower range of ports generally, whereas a syn scan is likely to try every port it can.
So, I suspect it depends on the network, but it still may be possible to differentiate the two. Indeed, another dimension is that you could analyse the traffic patterns generally. Syn scans do not involve data transfer, whereas bittorrent does, meaning the timings between syn/ack would be different.
Another observation - bittorrent syn connections should (you would expect) to be acknowledged, whereas a syn scan is likely to make many connections to closed ports.
This seems pretty secure, but I don't know much information about this, are there other common types of packets that one can send in large quantities to a network (to multiple ports or even a single port) that are about 40 bytes?
It is possible. According to this stackoverflow answer the minimum size for a UDP packet is 28 bytes with an empty datagram. If you wanted to confuse the statistics, you could send udp requests to the host with a payload of 12 bytes.
That said, I do not know of any protocol in genuine full time use that is exactly 40 bytes with any such regularity (i.e. the standard deviation would be very small). I suspect this is quite an accurate measure.