A Review of Deep Learning Applications in Intrusion Detection Systems: Overcoming Challenges in Spatiotemporal Feature Extraction and Data Imbalance

1. Introduction

With the rapid development of the Internet of Things (IoT) and large-scale distributed networks, network environments are becoming increasingly complex [1]. Therefore, intrusion detection systems (IDS) that ensure network security are now facing unprecedented challenges [2]. Especially in the face of spatiotemporal feature extraction and data imbalance issues, traditional intrusion detection methods are no longer able to adapt to complex network traffic environments [3,4,5,6,7,8].

The importance of spatiotemporal feature extraction in IDS is increasingly evident, as modern cyber-attacks often exhibit temporal dependencies and dynamic evolution [9]. Traditional feature extraction methods struggle to effectively capture these complex spatiotemporal dependencies, leading to a decline in detection performance [10]. Additionally, data imbalance is a pervasive issue in intrusion detection [6]. Normal traffic data typically constitutes the majority, while abnormal attack traffic is rare [11]. Due to the uneven distribution of data in traditional detection methods, the extracted attack data features tend to be biased towards a higher number of samples, while ignoring a lower number of samples. This issue can lead to a decrease in detection accuracy [5].

In recent years, deep learning techniques have shown immense potential in addressing the challenges of spatiotemporal feature extraction and data imbalance in complex network environments [12]. In recent years, many scholars have shown that deep learning models can effectively extract spatiotemporal features from network traffic [13,14]. To address the issue of data balancing, techniques such as Generative Adversarial Networks (GANs) can be used to increase the proportion of minority samples, thereby enhancing the overall detection capability of IDS [15].

However, significant challenges remain despite the progress made in applying deep learning to intrusion detection [16]. For instance, existing studies often overlook deep models’ interpretability and real-time performance when handling high-dimensional and dynamic network traffic data [17]. Additionally, current solutions to the data imbalance problem have limitations, with many methods proving inadequate in processing minority class data effectively, thus failing to achieve optimal detection performance in real-world applications [18,19].

Therefore, this article aims to systematically review the advancements in deep learning for spatiotemporal feature extraction and data imbalance handling. Figure 1 shows Data Flow In IDS, analyzes existing methods’ strengths and weaknesses, and proposes potential future research directions. By delving into these critical issues, this paper seeks to further provide new insights and ideas to enhance the performance and robustness of Intrusion Detection Systems.

The contributions of the paper can be outlined as:

• The paper reviews recent advancements in deep learning applications for IDS, focusing on challenges in spatiotemporal feature extraction.
• It evaluates techniques like CNNs, RNNs, and GANs in handling complex network traffic and addressing data imbalance to improve the detection of minority class attacks.
• The paper identifies key research gaps and proposes future directions to enhance the effectiveness and robustness of deep learning models in IDS.

2. Research Methodology

This section introduces the systematic literature review methodology applied to the proposed scheme, titled Deep Learning Applications in Intrusion Detection Systems: Overcoming Challenges in Spatiotemporal Feature Extraction and Data Imbalance. It outlines the article selection process and highlights the research questions to be discussed in the subsequent section. The selected articles were identified as follows, focusing on the context of deep learning, intrusion detection, spatiotemporal feature extraction, and data imbalance:

Relevant search strings were formulated based on the research context to identify the required articles.

To locate review articles within the intrusion detection domain, the following search strings were used:

• “Deep Learning Intrusion Detection Survey”
• “Deep Learning Intrusion Detection Review”
• “Deep Learning Intrusion Detection Overview”

These searches yielded several review articles, which were referenced in the introduction of this paper.

To identify survey articles on the application of deep learning-based spatiotemporal feature extraction and data imbalance in intrusion detection systems, the following search strings were used:

• “Deep Learning Spatiotemporal Feature Extraction Intrusion Detection Survey or Review”
• “Deep Learning Data Imbalance Intrusion Detection Survey or Review”

However, no articles matching these search strings were found.Similarly, to locate recent proposals and research articles within the context of deep learning-based misuse detection, the following search strings were employed:

• “Spatiotemporal Feature Extraction Intrusion Detection”
• “Data Imbalance Intrusion Detection”

The results from these searches were then filtered to identify credible and original research articles.

The articles primarily come from journals published by the publishers listed in Table 1. Patents, conference papers, and other documents not included in these journals will be excluded from this study. Most of the articles in this survey are sourced from IEEE, Elsevier, and Springer publications.

Figure 2. illustrates the number of relevant papers published on this topic in recent years up to February 2024. As shown in the figure, the number of these publications has been increasing, which indicates that this area is an active research field.

3. Challenges in Intrusion Detection Systems

IDS faces significant challenges, particularly in handling data imbalance and effectively extracting spatiotemporal features from network traffic, both of which are crucial for accurately detecting and responding to complex and evolving cyber threats. Figure 3 shows Challenges in Intrusion Detection Systems.

3.1. Complexity and Importance of Spatiotemporal Feature Extraction

In the modern cybersecurity landscape, particularly within the context of the Internet of Things (IoT) and large-scale distributed networks, IDS are confronted with increasingly sophisticated attack methods [20,21]. These attacks are highly dynamic and frequently exhibit pronounced spatiotemporal characteristics [17]. Traditional intrusion detection methods make it difficult to capture the complex spatiotemporal characteristics of network traffic, which allows attack behaviors to use temporal dependencies and spatial distributions to evade detection [22]. The complex sources of data include the following aspects:

1. Multidimensionality of Data: Network traffic data typically contains multiple dimensions, including network layer information and time-series data [23]. The interaction of these features increases the difficulty of extracting critical spatiotemporal patterns [24].

2. Heterogeneous Network Environments: The heterogeneity of different network nodes and devices makes it challenging for a unified feature extraction method to adapt to diverse network environments, thereby affecting detection accuracy [25].

3. Temporal Dependencies: Many attack behaviors exhibit temporal dependencies, which traditional static feature extraction methods fail to capture, leading to inadequate detection of complex attacks [26].

The key to improving the robustness and accuracy of IDS is to extract spatiotemporal features [27] effectively. Precise spatiotemporal analysis not only allows the system to maintain stability in the face of complex and evolving attack patterns but also significantly improves the detection of Advanced Persistent Threats (APT) and zero-day attacks [28,29]. To ensure sustained effectiveness in dynamic network environments, IDS must accurately capture temporal dependencies in network traffic [30].

3.2. Challenges of Data Imbalance

The pervasiveness of Data Imbalance: In cybersecurity, data imbalance is a widespread issue, particularly evident in IDS [31]. Normal traffic data typically dominates the dataset, while anomalous attack traffic is relatively rare [32]. The imbalance of sample distribution can cause the model to lean towards majority-class samples during training, while ignoring minority-class samples [33].

The challenges posed by data imbalance include:

Model Bias: Given the predominance of normal traffic, models are prone to becoming biased towards these data during training, failing to detect minority class attacks effectively [34].

Introduction of Noise and Information Loss: Traditional oversampling methods, such as SMOTE, can introduce noise, leading to overfitting [35]. On the contrary, using undersampling methods can lead to the loss of key information and weaken the overall detection capability of the model [36].

Computational Complexity: Advanced techniques like Generative Adversarial Networks (GANs) excel at generating minority class samples. However, their training involves multiple sources of complexity, such as iterative optimization, high computational costs, and hardware requirements, which limit their feasibility in real-world applications [37].

The problem of imbalanced samples in the dataset can increase false positive and false negative rates, thereby compromising the overall performance of IDS [38]. Overcoming data imbalance issues is particularly important when dealing with stealth attacks such as Advanced Persistent Threats (APTs) and zero day exploit [39,40]. As Table 2 shows A Impact of Data Imbalance on Model Performance.

4. Spatiotemporal Feature Extraction Techniques

4.1. Traditional Feature Extraction Methods

In the Internet of Things (IoT) context, researchers have employed various methods to extract network features. For example, three commonly used feature extraction algorithms have been compared: Principal Component Analysis (PCA), Linear Discriminant Analysis (LDA), and Autoencoders (AE). Among them, the core of PCA and LDA is singular value decomposition (SVD), while AE comprises encoder and decoder, which can extract features more effectively [41]. Although these methods can reduce data dimensionality and extract important features to some extent, they often struggle to handle complex spatiotemporal dependencies within the data, leading to inefficiencies in addressing dynamic attack patterns [27].

4.2. Application of Deep Learning Models

4.2.1. Convolutional Neural Networks (CNN)

CNNs exhibit significant advantages in processing spatial feature extraction. The convolutional and pooling layers within CNN can extract features from data and abstract them at higher levels. However, CNNs have limitations when dealing with time-series data, as they struggle to capture long-term dependencies, which restricts their application in handling complex spatiotemporal data [42,43,44].

4.2.3. Recurrent Neural Networks (RNN)

RNNs, particularly Long Short-Term Memory networks (LSTM), specialize in processing time-series data by remembering and utilizing historical information to predict future data points [45]. LSTM can extract long-term dependency features, but its efficiency in processing high-dimensional spatial data is relatively low [46]. Additionally, the complex structure of RNNs and LSTMs can increase computational costs in practical applications, which may become a bottleneck in intrusion detection tasks requiring high real-time performance [47].

In recent years, the performance of deep learning in feature extraction has been significantly improved. For example, on the CIC-IDS2017 dataset, the PSO-CNN model achieved an accuracy of 99.45%. On the UNSW-NB15 dataset, the model achieved a detection rate of 99.75% [22]. This method combines the advantages of CNN and Particle Swarm Optimization (PSO) algorithms and can effectively capture the spatial features of data. The CNN-GRU-FF model, which combines CNN with GRU (Gated Recurrent Unit), has also been proposed for spatiotemporal feature extraction. Reference [7] indicates that the hybrid model outperforms the other seven algorithms in extracting features from the NSL-KDD and UNSW-NB15 datasets. The model in the literature combines CNN and GRU models to extract spatial and temporal features respectively, demonstrating its powerful ability to capture complex attack patterns.

4.3. Autoencoders and Other Enhanced Methods

In the field of feature extraction, several studies have proposed improved methods based on autoencoders. For example, using an enhanced sparse autoencoder for latent feature extraction has shown promising performance in designing network IDS [17]. Additionally, feature extraction methods that combine word embedding models with TF-IDF and Word2Vec have demonstrated improved classification performance in intrusion detection, making these approaches more competitive among existing feature extraction methods [48].

4.4. Hybrid Spatiotemporal Feature Extraction Models

In recent years, the hybrid model of CNN and LSTM to extract spatial and temporal features has been widely studied [54], thereby providing a more comprehensive understanding of complex attack patterns. For instance, in extracting spatiotemporal features from network traffic, this hybrid network has an accuracy rate of over 99.50% in determining the main types of attacks [8]. This hybrid model uses CNN and LSTM to extract spatial and temporal features of traffic data, demonstrating extremely high processing efficiency.

As shows Table 3, Comparison of Existing Deep Learning Models for Spatiotemporal Feature Extraction in IDS.

4.5. Future Research Directions

Explore multi-level feature fusion methods that introduce interaction mechanisms across different network layers, allowing spatial and temporal features to be more tightly integrated. This would enable a more accurate capture of complex attack patterns [63,64].

4.5.1. Optimization of Computational Efficiency and Real-Time Processing

Research on compression and pruning techniques for neural networks to reduce the computational burden of hybrid models and enhance their real-time processing capabilities [65,66]. Such intrusion detection techniques are particularly important in network environments with insufficient computing resources [67].

4.5.2. Self-Supervised and Semi-Supervised Learning

Consider incorporating self-supervised or semi-supervised learning methods into hybrid models to leverage unlabeled data better, improving the model’s adaptability and generalization across different application scenarios [68,69,70,71].

4.5.3. 3D Convolutional Neural Network

The 3D convolution, also known as 3D convolution, is a Convolutional Neural Networks (CNN) technique used to process 3D data. Unlike standard 2D convolutions, 3D convolutions operate on three dimensions (usually depth, height, and width) to better synchronize temporal and spatial features [72,73].

4.5.4. Spatio-Temporal Convolutional Networks

Spatiotemporal Convolutional Network is a neural network model that combines spatial and temporal convolutions. It uses traditional two-dimensional convolution in the spatial dimension and introduces one-dimensional convolution in the temporal dimension. This structure enables the network to capture temporal and spatial data information [74] effectively.

4.5.5. Attention Mechanisms

Attention mechanisms can help the model assign different weights to each input part, extract critical and important information, and enable the model to make more accurate judgments without incurring greater computational and storage costs [75].

4.5.6. Transformer

Transformer uses an attention mechanism to replace the sequential dependency relationship in traditional recurrent neural networks (RNNs), which can better capture the global dependency relationship between input and output. Its advantage lies in its ability to consider all information and simultaneously find the relationships between them. This enables it to understand and generate language information more accurately than traditional models [76,77].

4.5.7. Spatio-Temporal Graph Neural Networks (ST-GNNs)

Future research could explore applying graph neural networks (GNNs) to spatio-temporal feature extraction better to capture complex spatial and temporal dependencies [78]. Traditional Convolutional Neural Networks (CNNs) struggle to handle the irregular relationships in graph-structured data. In contrast, GNNs can effectively capture the relationships and dependencies in irregular spatial layouts by aggregating and propagating node features over a graph structure. Extending GNNs to the temporal dimension to construct Spatio-Temporal Graph Neural Networks (ST-GNNs) allows for simultaneous consideration of spatial and temporal interactions in dynamically changing data [79,80].

5. Data Imbalance

5.1. Data Imbalance Handling Techniques

5.1.1. Traditional Oversampling Methods

Traditional oversampling methods balance datasets by generating minority types of samples, such as the Synthetic Minority oversampling Technique (SMOTE) [91]. Although SMOTE effectively improves the detection capability for minority classes in many cases, it has drawbacks, including the potential introduction of noise, particularly when the dataset’s quality is not high [98]. These noisy samples can lead to model overfitting, adversely affecting the model’s generalization ability on real-world data [99].

5.1.2. Undersampling Methods

The undersampling method reduces the number of majority class samples in the dataset [100]. However, a significant disadvantage of undersampling is the potential loss of valuable information [101]. When the majority class samples are excessively reduced, the model may fail to learn sufficient features from the majority class, thereby negatively impacting overall performance [36].

5.1.3. Generative Adversarial Networks (GANs)

Generative Adversarial Networks (GANs) have shown great potential in addressing data imbalance. GANs generate realistic minority class samples through adversarial training, significantly enhancing the diversity and representativeness of minority class data [102]. However, the training process of GAN is complex and requires many resources, and the model requires meticulous hyperparameter adjustment. Moreover, although GAN-generated samples are highly realistic, there is still a risk of mode collapse, where the diversity of the generated samples is insufficient, leading to a less effective representation of the minority class [103,104].

As shows Table 4, Comparison of Existing Data Imbalance Handling Techniques.

5.2. Limitations of Data Imbalance Handling Techniques

5.2.1. Overfitting and Noise Issues

The oversampling method, similar to SMOTE improves the dataset by increasing the number of minority class samples, but often introduces noise, especially when the quality of the original dataset is poor [105]. These noisy samples can cause the model to capture these artificial features during training, leading to overfitting [106]. Overfitted models generally perform poorly when exposed to new data, making them less effective in real-world applications [107].

5.2.2. Computational Complexity and Model Stability

Generative Adversarial Networks (GANs) exhibit significant advantages in addressing data imbalance, but their training process is inherently complex. Balancing generators and discriminators requires significant computational resources and parameter adjustments [108]. Additionally, there is a risk of mode collapse, where the model fails to generate diverse minority class samples, affecting its generalization ability across different attack patterns [109]. The challenges of hyperparameter tuning and maintaining training stability further increase the complexity and cost of implementing GANs in practical applications [110].

5.2.3. Lack of Adaptability and Scalability

Traditional data balancing methods, such as oversampling and undersampling, may perform well in fixed environments and with specific attack patterns, but they often lack the adaptability needed to cope with continuously evolving network threats and diverse attack modes [111,112]. As network environments become more complex and attack methods evolve, the scalability of these techniques becomes increasingly insufficient [113]. For instance, static sampling strategies may fail to dynamically adjust to new emerging attack patterns, leading to suboptimal model performance in real-world scenarios [114].

5.3. Future Research Directions

5.3.1. Adaptive Sampling Techniques

Future research should focus on combining hybrid deep-learning models with adaptive sampling techniques [115]. Dynamically adjusting the sampling rate based on the dataset structure can improve the model’s detection of minority categories, reduce overfitting, and enhance the performance of IDS in dynamic network environments [116,117,118,119].

5.3.2. Meta-Learning and GAN Integration

Combining meta-learning with GANs could create more adaptive and generalizable models. Meta-learning helps models quickly adapt to new attack patterns [120], while GANs generate realistic minority class samples, addressing data imbalance and improving model robustness [121,122].

5.3.3. Deep Learning and Traditional Methods Integration

Integrating deep learning techniques like GANs and LSTMs with traditional methods such as decision trees can enhance model interpretability and stability [135]. This hybrid approach improves the detection of minority classes and adapts better to evolving network threats [119].

5.3.4. Attention Mechanism

The attention mechanism can improve the performance and interpretability of the model by automatically learning which information should be focused on or ignored. When dealing with imbalanced data, attention mechanisms can help the model better focus on the features that are more critical for classification, thereby improving the model’s ability to recognize minority classes. However, this does not directly solve the problem of data imbalance; it indirectly affects the processing effect of imbalanced data by improving the adaptability and performance of the model to imbalanced data [116,136].

5.3.5. Multi-Task Learning

Multi-task learning aims to learn multiple related tasks simultaneously to improve the model’s performance on each task. Mathematically, multi-task learning can be represented as a joint optimization problem, where the model needs to be optimized simultaneously on multiple tasks. The core idea is that there are certain common features or patterns between different tasks, and by sharing these features, the learning ability of the model for each task can be enhanced[120,137].

5.3.6. Transfer Learning

Transfer learning typically involves using pre-trained models on large datasets and then transferring the feature extraction parts of these models to new, smaller datasets for fine-tuning and adapting to new tasks. This method is particularly suitable for datasets with a few categories, as pre-trained models may have already learned general feature representations that are very useful for identifying minority categories [137,138].

5.3.7. Signing of a New Loss Function

Reasonable loss function design and weight allocation can significantly improve the model’s training effectiveness and generalization ability. The weighted loss function is a modification of the standard loss function used during model training. Weight is used to allocate higher penalties for misclassification of minority categories, making the model more sensitive to minority categories by increasing the misclassification cost of that category. The most common method to implement a weighted loss function is to assign higher weights to minority classes and lower weights to majority classes. The weight can be inversely proportional to the frequency of the category [139,140].

5.3.8. Strategy of Combining Data Augmentation with Contrastive Learning

Future research could explore combining data augmentation techniques with contrastive learning to enhance the handling of imbalanced data. Contrastive learning is a self-supervised learning method that learns more discriminative feature representations by maximizing the similarity between similar samples and the difference between dissimilar samples [141]. When dealing with imbalanced data, data augmentation techniques can be used to generate diverse minority class samples, and contrastive learning can effectively distinguish these samples from majority class samples [142,143].

6. Conclusion

This article systematically analyzes the deep learning techniques used in IDS, focusing on the solutions to spatiotemporal feature extraction and data imbalance problems. We compared the performance of existing technologies and explored the advantages and disadvantages of the CNN-RNN hybrid model in capturing complex spatiotemporal features and the potential of GAN in solving data imbalance problems. However, the methods introduced in the article still have shortcomings and need to be improved in terms of computational efficiency, interpretability, and adaptability to dynamic network environments.

The contribution of this article is not only to summarize the current application status of deep learning technology in IDS, but also to deeply analyze and compare the performance of major hybrid models to clarify the future direction of the technology roadmap. Compared to existing literature, we propose new research directions, such as optimizing hybrid models through hierarchical feature fusion, introducing adaptive sampling strategies to enhance minority class detection, and combining meta-learning with GANs to improve model generalization.

7. Future Work

Future research should address the limitations of the current methods in terms of complexity, scalability, and computational resource requirements. Particularly in the face of rapidly evolving network threats, researchers need to develop more efficient and adaptive models to ensure that IDS can maintain high detection performance in dynamic environments. We recommend further practical testing to validate and refine these new techniques, thereby advancing the development of IDS. These research directions are crucial for enhancing IDS performance in diverse and complex network environments and lay a solid foundation for the future development of cybersecurity technologies.