## 5 Results
### Final Model Evaluation  
The selected models were trained using the datasets detailed in Section 5.2, namely CIC-DDoS2019 and N-BaIoT, widely referenced in the scientific literature for detecting DDoS attacks in IoT environments. The main objective of this stage was to evaluate the models' ability to identify anomalous patterns in the network traffic generated by compromised devices. Two complementary approaches were implemented: a Random Forest-based model and a Long Short-Term Memory (LSTM) architecture. Figure 6: Training accuracy and loss curves for Random Forest, XGBoost, and LSTM. In the case of Random Forest, the GridSearchCV technique was applied to optimize hyperparameters, such as the number of trees and maximum depth, with the aim of maximizing performance on both datasets. Two feature selection strategies were considered: (i) one based on the importance index provided by the Random Forest algorithm itself, and (ii) another using features previously selected using XGBoost. This comparison allowed us to analyze how different dimensionality reduction techniques affect the model's accuracy and efficiency. Regarding the LSTM model, the Keras and TensorFlow libraries were used for its implementation, given their potential for capturing temporal patterns in network traffic sequences. Due to the sequential nature of this architecture, the test set was reconfigured to generate suitable temporal sequences, applying normalization and dimensionality adjustment processes. The model was subsequently trained by adjusting key hyperparameters, such as the number of LSTM units and sequence length, to improve its performance in detecting anomalous traffic in IoT environments. To assess the classification performance of the proposed models, we generated ROC (Receiver Operating Characteristic) curves along with the corresponding Area Under the Curve (AUC) values for the Random Forest, XGBoost, and LSTM classifiers, as shown in Figure 7. These curves illustrate the trade-off between the true positive rate (sensitivity) and the false positive rate (1-specificity) across different decision thresholds. The AUC values provide a quantitative measure of each model's ability to distinguish between benign and malicious traffic. Higher AUC scores indicate better overall performance, making this analysis essential for validating the effectiveness of the models in detecting DDoS attacks. The ROC curves and corresponding AUC values illustrate the classification performance of the evaluated models. Random Forest achieved an AUC of approximately 0.99, indicating near-perfect discriminative capability. XGBoost followed with an AUC of 0.97, reflecting strong performance with slightly lower sensitivity. In contrast, the LSTM model obtained an AUC of 0.85, suggesting a moderate ability to distinguish between classes and confirming its lower recall observed in previous metrics. Overall, the closer the ROC curve approaches the top-left corner (TPR = 1, FPR = 0), the better the model's performance. These  
Figure 7: ROC curves and AUC values for the Random Forest, XGBoost, and LSTM models. results confirm Random Forest as the most effective model for DDoS detection in this study, with XGBoost also showing robust behavior and LSTM underperforming in comparison. The results obtained from the experiments show significant differences in the performance of the models evaluated in terms of accuracy, recall and F1-score, as well as in the ability to detect anomalous patterns in network traffic. Conclusions and recommendations derived from these results are presented in Table 5.  
According to the metrics obtained:  
* Accuracy: The Random Forest model achieved a very high accuracy, close to 99.96%, in detecting anomalous patterns in network traffic. The XGBoost model also showed a high accuracy, about 95.80%, while the LSTM model achieved a lower accuracy, about 89.81%. * recall: The Recall of the Random Forest model was high, approximately 92.02%, indicating a good ability to identify positive cases.