A rule-based system catches the DDoS attack you’ve already seen. An attacker who stays under your volumetric threshold walks past it.
Machine learning changes the question from “is traffic above X requests per second” to “does this traffic look structurally normal” — timing, source entropy, protocol distribution. Low-volume attacks with improbable source diversity still register as wrong.
The part I spent the most time on was where it breaks: a 1% false-positive rate sounds excellent until you apply it to millions of requests per hour, at which point it’s an alert queue nobody reads. Worse than no system at all.