I am not really sure you need ML for basic ddos protection. For the most part, you can just track incoming connections, and compare to historical dates at that same day of the week/time.

There are other, more complex, options, taking into consideration various features of those incoming requests to detect between something like a news article that was written about you, sending thousands of people suddenly your way vs a ddos though. For that, I would expect just about any regular classification algorithm to be acceptable. SVM or KNN would be my first start.