I have seen numerous research papers that claim it is "easy to detect network layer DDoS attacks" without saying why. Usually these research papers focus on detection or prevention of application layer attacks, which is why they don't go into detail about network layer attacks. Why is it easy to detect network layer attacks? One of the papers I am looking at says "In network-layer DDoS attacks, attackers send a large number of bogus packets (packets with bogus payload and invalid SYN and ACK number)". Why not just open up a large number of "new connections" with valid data, other than a spoofed IP address? Yes, I suppose it would be easy to detect when you've just received a packet with an invalid packet header. But what about when you receive a lot of packets with valid headers, that are nonetheless from spoofed IPs?
Network-layer DDoS attacks typically involve a lot of very similar traffic; it follows a discernable pattern, it appears in statistically unusual quantities, and it looks very different from the surrounding "normal" traffic.
That's what makes it easy to identify.
The traffic tends to look very different, depending on the protocol being used. SYN floods, for example, are distinguished by a large increase in the number of two-packet sessions, representing one SYN from the attacker, and one SYN-ACK from the victim. If you're monitoring your connections, and you see a large increase in both volume and source IP diversity, you can be pretty sure you're under DDOS attack.
It is important to distinguish between "easy to detect" and "easy to distinguish" however -- knowing "I'm under DDOS attack" doesn't help you figure out which individual sessions are malicious and which aren't. You have to look at each individual session, and sometimes the sessions look normal but are just truncated.
Yes, I suppose it would be easy to detect when you've just received a packet with an invalid packet header. But what about when you receive a lot of packets with valid headers, that are nonetheless from spoofed IPs?
This is "Tackling Application-layer DDoS Attacks" by Hakem Beitollahi and Geert Deconinck, yes? I think that what the authors are doing is using valid vs. invalid headers as a way of distinguishing types of attack. They seem to be defining attacks using packets with valid headers as application layer attacks, and invalid-header packets as network layer attacks. So, they're not necessarily claiming that one is done more often than the other, or more effective than the other: they're just defining a smaller problem that they then address with their ConnectionScore system.
Why DDos attacks are easy to detect?
Because its in the nature of the attack; it doesn't hide itself it is no way a stealth attack its not like great white shark attacking you; its more of situation where you are being hit by huge ice-berg.
Why spoofing IP is hard?
Now, for technical bits, Spoofing an IPS addresses wouldn't get you far because like in cisco asa 5885 with bultin in AIP module it works in-line but on LAYER-2 meaning all the traffic goes by un-detected. Even its not picked by traceroute packet. This feature is for the reasons you just suggested in your last lines; its IPS defense mechanism.
Also, it is recommended that the IPS is placed behind the firewall not infront of it; as placing it in front causes it receives un-wanted traffic overwhelming its signature engine,It make sense that IPS only do analysis on authorized / allowed traffic. So IPS in that case would be hidden automatically by firewall.