Meta-learning emerges as a promising path for cloud DDoS detection

Denial of Service and Distributed Denial of Service attacks remain among the most persistent and rapidly evolving threats to modern network infrastructure, increasingly disrupting the availability, reliability and security of cloud-based systems, Software-Defined Networks, Internet of Things ecosystems and next-generation communication environments, according to a new systematic review published in Frontiers in Artificial Intelligence.

The review, based on an examination of 120 papers — 114 primary studies and 6 supplementary studies — traces the evolution of DoS and DDoS attack detection from early statistical and anomaly-based methods through adaptive machine learning and deep learning to domain-specific detection approaches. Its synthesis covers network and application-layer detection, protocol-specific detection frameworks, cloud-based intrusion detection systems, SDN-enabled programmable detection, IoT, fog and edge architectures, ensemble and hybrid models, transfer learning, and blockchain-based security mechanisms.

A key finding concerns benchmark datasets, feature engineering and comparative performance: current deep learning systems attain almost perfect classification rates in experimental environments, but the review concludes that fundamental limitations in generalizability, computational efficiency, privacy preservation and explainability remain a constraint on their deployment in real-world settings. High laboratory scores, in other words, do not yet translate into dependable real-world protection.

The authors also highlight a striking gap in the research landscape: fewer than 6 percent of the reviewed studies — seven out of 120 — explicitly use meta-learning, transfer learning or few-shot approaches. The review interprets this as reflecting an ongoing lack of capability in adaptive generalization, and a deficiency in addressing zero-day attacks and domain shift in dynamic cloud environments, where detection systems trained on one domain must cope with new traffic patterns and attack types in another.

As its forward-looking contribution, the review proposes meta-learning as the most promising emerging paradigm for next-generation cloud-based intrusion detection. Meta-learning systems can, in principle, be adapted to new domains with very few labeled examples, directly addressing three key limitations of existing approaches: the zero-day detection gap, domain shift limitations and label scarcity. The authors stress that this is a proposed research direction rather than a demonstrated deployed solution.

By mapping the field’s evolution and identifying where adaptive methods are underused, the review aims to offer researchers and practitioners a structured basis for designing explainable, privacy-preserving and computationally efficient detection systems, and to highlight the critical need for moving toward cloud-based intrusion detection built on meta-learning.

Subject of Research: A systematic review of DoS and DDoS attack detection in cloud environments and the emerging role of meta-learning

Article Title: A systematic review of DoS and DDoS attack detection in cloud environments: evolutionary trends and the emerging role of meta-learning for cross-domain adaptability

Article References: Tiwari, A., & Navaneethan, C. (2026). A systematic review of DoS and DDoS attack detection in cloud environments: evolutionary trends and the emerging role of meta-learning for cross-domain adaptability. Frontiers in Artificial Intelligence, 9, Article 1958096. https://doi.org/10.3389/frai.2026.1958096

Image Credits: AI Generated

DOI: 10.3389/frai.2026.1958096

Keywords: DDoS, DoS, cloud security, intrusion detection, meta-learning, deep learning, systematic review, zero-day attacks, domain shift, transfer learning, SDN, IoT