A system detects the presence of illegal access attacks. The device for analyzing and diagnosing network traffic divides packets into k (k>0) types based on protocol type and port number, etc., a component observing the number of distinct values of one or more pre-specified fields in packet header for each packet type, for all packets that have transited the observation points in a network, an element observing the number of distinct values of one or more pre-specified fields in the packet payload for each packet type, for all packets that have transited the observation points in a network, and a diagnosis element determining whether the network is abnormal when the number of distinct values observed in fields of each packet type crosses a specified ratio-threshold within a predetermined interval. This enables detection of small-scale DoS attacks with little change in addresses number, improving illegal access detection accuracy.