## 6 Discussion
### Comparative Performance Analysis of ML/DL Models  
Experimental evaluation showed that ensemble-based models, particularly Random Forest (RF), significantly outperformed deep-learning models such as Long Short-Term Memory (LSTM) in detecting DDoS attacks in IoT/Cloud environments. This finding is in line with recent published works [15], which highlighted the higher accuracy and lower computational demand of tree-based methods in industrial cybersecurity contexts. RF achieved an exceptional accuracy of 99.96% and an F1-score of 95.84%, confirming its robustness in distinguishing between benign and malicious traffic. The high precision (99.96%) and F1-score (95.84%) achieved by the Random Forest model may suggest the presence of class imbalance, particularly a predominance of malicious traffic over benign samples in both the CIC-DDoS2019 and N-BaIoT datasets. To mitigate this issue and ensure fair model evaluation, class balancing strategies were applied during the training phase, including subsampling and class weighting. These techniques helped reduce the bias toward the majority class and improved the model's ability to correctly classify minority class instances.  
Figure 8: Confusion matrices of Random Forest, XGBoost, and LSTM models showing classification performance for DDoS detection.  
Additionally, performance was assessed using robust metrics beyond accuracy, such as F1-score, confusion matrices, and ROC curves, to validate the generalization capacity of the models across both classes. This approach confirmed that the observed performance was not merely a reflection of class distribution but a result of effective learning and discrimination between benign and malicious traffic. This result is in line with the findings of [10], who also emphasized the importance of using Random Forest Feature Importance (RFFI) for high accuracy anomaly detection. XGBoost also showed strong performance (F1-score of 87.02%), with slightly lower recall than RF, suggesting its effectiveness in classification, but slightly reduced sensitivity to minority class instances. The model gain-based feature importance metric proved efficient in identifying key predictive variables, supporting claims made in other publications [11], where federated and optimized models demonstrated high efficacy in resource-constrained environments. In contrast, the LSTM model underperformed across all metrics (F1-score of 53.04%), echoing concerns raised by [24], who noted that unoptimized LSTM configurations can struggle with convergence and generalization, particularly on imbalanced and heterogeneous datasets typical of IoT scenarios. This limitation reflects the challenges inherent in applying deep-sequence models in real-time edge environments without adequate data volume, temporal structuring, or advanced preprocessing techniques. Table 6 presents a comparison of the computational complexity of the evaluated models. Random Forest was the most efficient, with low training time and no GPU requirement. XGBoost incurred higher overhead due to its iterative nature. LSTM exhibited the highest computational cost, requiring a GPU and more training cycles, which partially explains its lower performance. This analysis highlights the trade off between efficiency and computational demands, which is critical for deployment in IoT/Cloud environments.  
Beyond accuracy and detection performance, the computational complexity of each model was also analyzed to assess their practical feasibility in IoT/Cloud scenarios. Table 6 summarizes the estimated training times, hardware requirements, and general observations. Random Forest demonstrated the lowest computational burden, training efficiently on CPU. XGBoost required more processing time due to its iterative nature. In contrast, LSTM demanded GPU acceleration and significantly longer training cycles, partially explaining its lower performance under constrained conditions.