First response, please don't flame :-)
If I understand your question correctly then yes you could think of attacks as a sub-set of anomalies. In some cases this is useful, but not terribly. If, for example, you have a very quiet network segment that never sees any traffic and all of a sudden you get slammed. The traffic change is an anomaly that could be an intentional DoS, or maybe you just put your website on search-engine-x and it finally got some traffic. The reality of the situation is contextual, one of the reasons that tuning your firewalls/ips/ids/etc is so important. It would be my advice to look at both independently and also consider them holistically. Tune, adjust, refine.
From an analysis point of view you would even say that consistent attacks, ie the standard, which suddenly disappear would also raise a red flag. Posit: your network has been getting low level probes from a specific IP range for a month straight. These types of nuisance scans are often over-looked but today, for no reason that you can tell, they stop. This is an anomaly for the network traffic patterns, but is it a good or a bad thing?
As to the last part; malignant network activity (DoS, Probes) and intrusion detection (looking at u2r/r2l/etc activities) are two different classes of detection analysis.
There is a decent paper on this at http://cs.fit.edu/~mmahoney/dist/ although it's a little dated I think it is still salient to your question.
