A rule-based system catches the DDoS attack you’ve already seen. An attacker who stays under your volumetric threshold walks past it. Machine learning changes the question from “is traffic above X requests per second” to “does this traffic look structurally normal” — timing, source entropy, protocol distribution. Low-volume attacks with improbable source diversity still register…