###### Abstract
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Method Name** & **Advantages** & **Limitations** & **Application Scenarios** & **Implementation Complexity** \\ \hline Deep Learning Models & Accurately detects complex & Requires large labeled datasets & Large-scale, complex IoT networks & High \\  & intrusion patterns & for training & & \\ Cryptography & Provides strong data protection, & & & \\  & prevents data leakage & & & \\  & & & & \\ Rule-based IDS/IPS & Low latency, easy to implement & Difficult to adapt to new attacks, high & Small-scale IoT networks, & Low \\  & & false-positive rate & low-resource environments & High \\ Blockchain Technology & Decentralized, no single point of & Slow processing speed, high & High availability, decentralized systems & High \\  & failure, provides high availability & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Methods for Enhancing IoT Security. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Model** & **Working Principle** & **Advantages** & **Challenges** & **Attack Types** & **Performance Metrics** & **References** \\ \hline  & CNN utilizes & & Poor handling of & & \\  & convolutional layers to & & time dependencies. & & \\  & automatically extract & & When used for & attacks, port scanning, & \\  & spatial features, making it & Excellent at extracting & time-series data, & brute-force attacks, & \\  & suitable grid-like data & spatial features, & additional structural and & other static attacks. & & \\  & such as images and & capable of handling & modifications are & Less effective for & 91–93\% (DDoS,\) & \\  & videos. It is effective for & high-dimensional data, & needed. High & time-dependent & brute-force, higher \\  & static data, and can be & and has good & computational cost. & attacks like SQL & false-positive rate \\  & extended to handle & generalization ability. & Poor performance in & injection or & \\  & time-series data using & & detecting long- & spoofing attacks. & \\  & Temporal Convolutional & & duration attacks. & & \\  & Networks (TCN). & & & & \\ \hline  & RNN focuses on & & Struggles with long & & \\  & capturing temporal dependencies in & Well suited for & sequences due to & & \\  & time-series data, making & time-series data, & issues like gradient & & \\  & it suitable for sequential & capable of learning & vanishing or & malicious traffic & \\  & data. It can be extended & temporal & explosion. Requires & detection, and & \\  & to Bidirectional RNN or & dependencies and & long training times & time-dependent & \\  & Gated Recurrent Units & dynamic changes in & and large amounts & attacks like phishing & \\  & (GRU) for & the data. & of data & and DoS attacks. & \\  & enhanced capabilities. & & for optimization. & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Performance Analysis of CNN, RNN, and LSTM in IDS. However, significant challenges remain despite the progress made in applying deep learning to intrusion detection [22; 23]. For instance, existing studies often overlook deep models' interpretability and real-time performance when handling high-dimensional and dynamic network traffic data [24]. Additionally, current solutions to the data imbalance problem have limitations, with many methods proving inadequate in processing minority class data effectively, thus failing to achieve optimal detection performance in real-world applications [25; 26]. Therefore, this article aims to systematically review the advancements in deep learning for spatiotemporal feature extraction and data imbalance handling. Figure 1 shows the data flow in IDS, analyzes existing methods' strengths and weaknesses, and proposes potential future research directions. By delving into these critical issues, this paper seeks to further provide new insights and ideas to enhance the performance and robustness of Intrusion Detection Systems.