Cloud computing has become the backbone of modern digital services, but its shared and distributed nature makes it an attractive target for cyber-attacks. Intrusion Detection Systems (IDS) built with machine learning and deep learning are now central to cloud security, and a large body of recent work tries to improve them with metaheuristic optimization for feature selection and model tuning. This paper presents a systematic literature review of hybrid optimization-driven machine learning frameworks for intrusion detection, with a focus on cloud and cloud-adjacent (IoT and IIoT) environments. Following a PRISMA-based review process, 30 peer-reviewed studies published between 2008 and 2026 were selected and analysed. The review organises the literature into four themes: cloud intrusion detection with feature selection, hybrid and improved metaheuristic optimization methods, CNN–LSTM and other optimized deep learning models, and foundational or survey work. A comparative analysis of the feature selection method, optimizer design, classifier type and data-balancing strategy used in each study is presented, along with the trend of publications over time. The review finds that although metaheuristic feature selection and CNN–LSTM classifiers are both well studied on their own, very few studies combine a hybrid dual-optimizer search with a CNN–LSTM classifier specifically for cloud network traffic, and fewer still report search overhead or explain their model's decisions. These gaps are summarised to guide future research and form the basis of an ongoing dissertation project.

Keywords—Cloud security, Intrusion detection system, Systematic literature review, Feature selection, Metaheuristic optimization, Grey Wolf Optimizer, Particle Swarm Optimization, CNN–LSTM, Machine learning.