###### Abstract  
In the rapid development of the Internet of Things (IoT) and large-scale distributed networks, Intrusion Detection Systems (IDS) face significant challenges in handling complex spatiotemporal features and addressing data imbalance issues. This article systematically reviews recent advancements in applying deep learning techniques in IDS, focusing on the core challenges of spatiotemporal feature extraction and data imbalance. First, this article analyzes the spatiotemporal dependencies of Convolutional Neural Networks (CNN) and Recurrent Neural Networks (RNN) in network traffic feature extraction and examines the main methods these models use to solve this problem. Next, the impact of data imbalance on IDS performance is explored, and the effectiveness of various data augmentation and handling techniques, including Generative Adversarial Networks (GANs) and resampling methods, in improving the detection of minority class attacks is assessed. Finally, the paper highlights the current research gaps and proposes future research directions to optimize deep learning models further to enhance the detection capabilities and robustness of IDS in complex network environments. This review provides researchers with a comprehensive perspective, helping them identify the challenges in the current field and laying a foundation for future research efforts. deep learning; intrusion detection systems (IDS); spatiotemporal feature extraction; data imbalance; convolutional neural networks (CNNs); generative adversarial networks (GANs); minority class attacks +
Footnote †: journal: Applied sciences  
data imbalance is a pervasive issue in intrusion detection [6]. Normal traffic data attack typically constitutes the majority, while abnormal attack traffic is rare [11]. Due to the uneven distribution of data in traditional detection methods, the extracted attack data features tend to be biased towards a higher number of samples while ignoring a lower number of samples. This issue can lead to a decrease in detection accuracy [5]. In recent years, deep learning techniques have shown tremendous potential in enhancing the security of the Internet of Things (IoT). Table 1 presents a detailed comparison of commonly used methods for enhancing IoT security, outlining their respective advantages and limitations. In particular, deep learning has attracted significant attention due to its ability to accurately detect complex intrusion patterns. Numerous studies have demonstrated that deep learning models can effectively extract spatiotemporal features from network traffic, addressing challenges that traditional methods often struggle to resolve [12; 13; 14]. Convolutional Neural Networks (CNNs) have been widely used for feature extraction in network traffic, particularly for spatial features, while Recurrent Neural Networks (RNNs) and Long Short-Term Memory (LSTM) networks excel at handling sequential data and modeling spatiotemporal dependencies, especially in detecting complex attack patterns. Numerous real-world case studies have demonstrated that these deep learning models significantly enhance the detection accuracy and robustness of Intrusion Detection Systems (IDS) in practical environments [15; 16; 17; 18; 19; 20; 21]. Table 2 presents an analysis of the performance of various algorithms in Intrusion Detection Systems (IDS).