This is a puzzling question. The explanation is provided right there in the paper, in some cases right near the quotations you provided. Perhaps it is worth re-reading the papers through a second time, as it sounds like you might have missed a few details on the first pass.
On the first quotation ("traditional anomaly detection algorithms require..."):
- Well, that's just how traditional anomaly detection algorithms work. Those algorithms work by starting with a training set of normal traffic, and then they use the training set to build a model of what normal traffic looks like. For this to work right, you need a large collection of normal traffic. As the paper states in the very next sentence, "if the data contains some intrusions buried within the training data, the algorithm may not detect future instances of these attacks because it will assume that they are normal". If you want more details on how those sort of algorithms work, then your best bet might be to read some papers that provide examples of algorithms of this form.
On the second quotation (assumptions in unsupervised techniques):
I think it's obvious why we need to assume that attack traffic looks different from normal traffic. If they looked the same, we'd have no way to detect attack traffic.
As far as why the unsupervised technique of Nieves needs legitimate traffic to be a lot more common than attack traffic: this is explained in Section 4.4 of the paper. It's because the paper assumes that small clusters represent attack traffic. Without this assumption, it's not clear how we could tell which of the traffic in our training set was normal and which was attack traffic, without labels. Remember, the paper assumes we have a training set with a lot of traffic, containing a mixture of both normal and attack traffic, and we don't have any labels to tell of us which of the data in the training set is normal and which is malicious.
As the paper explains, "Based on our assumption that a real network contains many more normal connections than attacks, [we consider] the smaller clusters to contain attacks and the bigger clusters [...] to contain normal or good connections" (slight adjustments to grammar to make it clearer). In other words, that's just how Nieves' proposal works. Of course there's nothing that says this is the only possible way to do intrusion detection -- but it gives some explanation why Nieves chose to try out the particular scheme he did.
My earlier answer:
It's hard to know without context (you should've provided a link or citation to the specific paper you're referring to). Without that, we can only guess.
They might be referring to the difference between supervised learning and unsupervised learning. In supervised learning, we assume that we have a large training set containing many packets, and every packet is labeled as either 'malicious' or 'legit'.
In unsupervised learning, we assume we have a large data set containing many packets, but none of them are labeled. If you don't have labels for the training data, about all you can do is cluster the data into one or more clusters.
Finally, there's one more situation that is common for anomaly-based IDS's: we are given a large training set containing many packets, and it is assumed that everything in this training set is legit (non-malicious) and representative of normal non-malicious traffic. Then, one can try to build a model of what normal traffic looks like; during operation, if you see any packet that deviates from the model, then it might be an attack. This is the basic concept of anomaly detection. There are many ways to build a model of normal traffic, but one possibility is to use clustering (e.g., K-means) to cluster the normal traffic into one or more clusters; during operation, any packet in or near one of those clusters is assumed to be normal, non-malicious traffic. If this is what's going on, you can see that this works even if there is only one cluster.
If I had to make a guess, my guess would be on the latter explanation. But without a paper citation, it's hard to say for certain.
P.S. No matter what technique is used, you can hopefully see why it is important that anomalies (i.e., malicious traffic) differs from normal traffic. If malicious traffic looked the same as normal traffic, you'd have no hope of detecting it. And, indeed, the entire definition of an anomaly is "something that's different from normal", so for anomaly detection to be useful at detecting attacks, we have to assume that malicious traffic is anomalous (different from normal traffic).
