Services can have trouble for a variety of reasons, not necessarily DDoS attacks.
a detection system may desire to optimize recall at the expense of precision, thus choosing a lower λ and forcing the system to predict attacks more often.