There are several entries in my router's log file showing recent DoS attempts on some of its ports. They look like this:

```
[DoS Attack: ACK Scan] from source: 213.61.245.234, port 80, Friday, November 21,2014 11:37:59
[DoS Attack: ACK Scan] from source: 80.239.159.8, port 443, Friday, November 21,2014 11:18:09
...
[DoS Attack: RST Scan] from source: 195.39.197.142, port 30732, Wednesday, November 19,2014 22:12:35
[DoS Attack: ACK Scan] from source: 31.13.91.117, port 443, Wednesday, November 19,2014 17:56:38
[DoS Attack: ACK Scan] from source: 88.221.82.74, port 443, Wednesday, November 19,2014 17:56:33
[DoS Attack: ACK Scan] from source: 31.13.91.117, port 443, Wednesday, November 19,2014 17:56:06
[DoS Attack: ACK Scan] from source: 88.221.82.74, port 443, Wednesday, November 19,2014 17:56:01
[DoS Attack: ACK Scan] from source: 31.13.91.117, port 443, Wednesday, November 19,2014 17:55:50
[DoS Attack: ACK Scan] from source: 88.221.82.74, port 443, Wednesday, November 19,2014 17:55:44
[DoS Attack: ACK Scan] from source: 31.13.91.117, port 443, Wednesday, November 19,2014 17:55:38
[DoS Attack: ACK Scan] from source: 88.221.82.74, port 443, Wednesday, November 19,2014 17:55:36
[DoS Attack: ACK Scan] from source: 31.13.91.117, port 443, Wednesday, November 19,2014 17:55:36
[DoS Attack: ACK Scan] from source: 88.221.82.74, port 443, Wednesday, November 19,2014 17:55:30
[DoS Attack: RST Scan] from source: 128.199.49.106, port 18668, Wednesday, November 19,2014 15:06:46

```

Tried scanning my router's public IP for open ports:

```
sudo nmap <my-public-ip> -Pn --reason --top-ports 10

Starting Nmap 6.47 ( http://nmap.org ) at 2014-11-21 16:02 CET
Nmap scan report for <public-hostname> (<my-public-ip>)
Host is up, received user-set.
PORT     STATE    SERVICE       REASON
21/tcp   filtered ftp           no-response
22/tcp   filtered ssh           no-response
23/tcp   filtered telnet        no-response
25/tcp   filtered smtp          no-response
80/tcp   filtered http          no-response
110/tcp  filtered pop3          no-response
139/tcp  filtered netbios-ssn   no-response
443/tcp  filtered https         no-response
445/tcp  filtered microsoft-ds  no-response
3389/tcp filtered ms-wbt-server no-response

```

I'm curious, how does my router know that each one is a DoS attack in the first place? Are these cases of using `nmap` aggressively in some way? And should I be worried about these attacks?