The rapid expansion of Internet of Things (IoT) deployments has increased the exposure of distributed devices, gateways, communication networks, and cloud-edge infrastructures to denial-of-service (DoS), distributed denial-of-service (DDoS), botnet, and volumetric attacks. Conventional intrusion detection approaches often face difficulties in distinguishing malicious traffic from legitimate high-volume activity while maintaining low computational overhead and rapid response. This paper proposes a Global Firefly Optimization Model (GFOM) for IoT attack detection, integrating firefly-based global optimization with an IoT-oriented attack detection architecture. The proposed model treats feature selection, detection-parameter optimization, and attack classification as interconnected optimization problems. Its theoretical foundation is derived from the observed limitations of existing IoT DDoS detection, SDN-based mitigation, edge defense, deep learning, and fog-enabled security approaches. The model introduces a multi-stage workflow consisting of traffic acquisition, preprocessing, discriminative feature construction, firefly-based global optimization, attack classification, confidence assessment, and response prioritization. The methodology emphasizes global search capability to reduce redundant feature combinations and improve detection-model configuration. The literature indicates that efficient mitigation requires coordination across IoT, edge, SDN, fog, and cloud layers rather than isolated detection mechanisms. The proposed framework therefore positions optimization as an intermediary intelligence layer between raw network observations and security decisions. The study provides a theoretically grounded architecture and evaluation methodology for developing adaptive IoT attack detection systems while recognizing that empirical validation on benchmark and real-world traffic datasets remains necessary.