## 3 Background
### Challenges Identified  
Firstly, the literature supports the problems identified, making it crucial to implement robust solutions that can adapt to the constant evolution of the threats under study. In this context, the use of Machine Learning (ML) appears as a promising tool, allowing not only the early detection of attacks but also the adaptation to new tactics used by attackers. Studying the efficiency of new models, or improvements to existing models, is essential to improve the responsiveness of systems to intrusions.  
Likewise, the use of metaheuristics to optimize the parameters of these models can result in significantly improved performance, facilitating the identification of complex patterns that might go undetected with traditional approaches. The literature addresses it very briefly for DDoS attacks in general, obtaining promising results, but no studies were found that deepen its use in IoT/Cloud-specific architecture, suggesting a future opportunity to investigate and develop specific strategies for this type of environment.  
The continuous evolution in algorithms provides an opportunity to explore novel methodologies that integrate the necessary tools that help not only to improve the security of IT systems in general but also to collaborate in improving the resilience of critical infrastructures that rely on cloud connectivity and processing, taking into account the importance of adaptability to protect against ever changing threats.  
To provide a clearer perspective on how our proposed approach aligns with and differentiates itself from recent advancements in the field, Table 2 presents a comparative summary of state-of-the-art-learning-based schemes for DDoS detection in IoT and Cloud environments. This includes a variety of machine-learning and deep-learning models, hybrid architectures, and optimization strategies applied across different network contexts. The table highlights key techniques, deployment environments, and reported results, offering a comprehensive benchmark to position our work relative to existing literature.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Reference** & **Model Type** & **Technique(s)** & **Environment** & **Results/Highlights** \\ \hline \multirow{2}{*}{[PERSON] et al. [4]} & \multirow{2}{*}{CNN-BiLSTM} & \multirow{2}{*}{Hybrid Deep Learning} & \multirow{2}{*}{Cloud/IoT} & High accuracy in complex DDoS scenarios; uses \\  & & & spatial-temporal patterns \\ \hline \multirow{2}{*}{[PERSON] et al. [7]} & \multirow{2}{*}{CNN-GRU} & \multirow{2}{*}{Edge-Based Hybrid DL} & \multirow{2}{*}{IIoT (Edge)} & Strong detection performance; suitable for edge deployment \\ \cline{3-3} \cline{5-5}  & & & Conditional Variational & \multirow{2}{*}{IoT Botnet} & Achieved 99.5\% accuracy using feature engineering \\ \cline{3-3} \cline{5-5}  & & Autoencoder + Hyperparameter tuning & & & \\ \hline \multirow{2}{*}{[PERSON] et al. [13]} & \multirow{2}{*}{ML Ensemble} & \multirow{2}{*}{SVM + Random Forest} & \multirow{2}{*}{Cloud Networks} & Adaptive detection under high traffic variability \\ \cline{3-3} \cline{5-5}  & & & & \\ \hline \multirow{2}{*}{[PERSON] et al. [17]} & \multirow{2}{*}{Random Forest + WOA} & \multirow{2}{*}{
\begin{tabular}{} \end{tabular} } & \multirow{2}{*}{IoT} & Improved classification with optimal feature subset \\ \cline{3-3} \cline{5-5}  & & & & \\ \hline \multirow{2}{*}{[PERSON] et al. [18]} & \multirow{2}{*}{PSO + LSTM} & \multirow{2}{*}{Swarm Optimization + Deep Learning} & \multirow{2}{*}{Cloud} & PSO enhanced LSTM accuracy; reduced convergence time \\ \cline{3-3} \cline{5-5}  & & & & \\ \hline \hline \end{tabular}
\end{table}
Table 2: Comparison of recent learning-based schemes for DDoS detection.