## 4 Spatiotemporal Feature Extraction Techniques
### Application of Deep Learning Models
#### 4.2.2 Recurrent Neural Networks (RNNs)  
RNNs, particularly Long Short-Term Memory networks (LSTMs), specialize in processing time-series data by remembering and utilizing historical information to predict future data points [57]. LSTM can extract long-term dependency features, but its efficiency in processing high-dimensional spatial data is relatively low [58]. Additionally, the complex structure of  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**ID** & **Dataset** & **Class Distribution** & **Model** & **Precision** & **Recall** & **Fl-Score** & **Accuracy** & **Reference** \\ \hline \multirow{3}{*}{1} & NSL-KDD dataset & Dos: 53,387, Normal: 7052 & RF & 0.70 & 0.65 & 0.70 & - & [48, 49] \\  & D6: 14,077, R2L: 3880 & SVM & 0.75 & 0.60 & 0.65 & - & [48, 49] \\  & U2R: 119 & MLP & 0.81 & 0.78 & 0.72 & - & \\ \hline \multirow{3}{*}{2} & \multirow{3}{*}{CIC-IDS-2017} & BENIGN: 2,273,097 & RF & 0.95 & 0.95 & 0.63 & 0.98 & \\  & & WebAttack: 673 & LightGBM & 0.59 & 0.97 & 0.64 & 0.98 & \\  & & Bot: 1966 & Xgboost & 0.93 & 0.99 & 0.52 & 0.99 & \\  & & PortScan: 158,930 & CatBoost & 0.91 & 0.98 & 0.94 & 0.99 & \\ \hline \multirow{3}{*}{3} & \multirow{3}{*}{KDD-CUP99} & CNN & 0 & 0 & 0 & 0.784 & \multirow{3}{*}{[51]} \\  & & DoS: 3,883,370 & CNN + GAN & 0.35 & 0.16 & 0.21 & 0.807 & \\  & R2L: 1126 & CNN + VAE + GAN & 0.12 & 0.07 & 0.09 & 0.814 & The situation \\  & U2R: 52 & MLP & 0 & 0 & 0 & 0.80 & where zeros \\  & & Probe: 41,02 & MLP + GAN & 0.44 & 0.1 & 0.16 & 0.812 & appear may \\  & & Precision, Recall, and F1-Score & MLP + VAE + GAN & 0.52 & 0.1 & 0.16 & 0.83 & be due to a \\  & & are focused on the minority & RNN & 0 & 0 & 0 & 0.76 & severe data \\  & & class data U2R & RNN + GAN & 0.05 & 0.01 & 0.02 & 0.80 & imbalance. \\  & & RNN + VAE + GAN & 0.04 & 0.01 & 0.02 & 0.81 & \\ \hline \multirow{3}{*}{4} & \multirow{3}{*}{WSN-DS dataset} & Normal: 340,066 & Decision Tree & 0.97 & 0.98 & 0.97 & 0.975 & \\  & & Random & & & & & & \\  & & Grayhole: 10,049 & Forest & 0.98 & 0.98 & 0.97 & 0.976 & \\  & & TDMA: 3312 & Naive Bayes & 0.88 & 0.93 & 0.9 & 0.925 & \\  & & Flooding: 6038 & STLGBM-DDS approach & 0.99 & 0.99 & 0.99 & 0.995 & \\ \hline \multirow{3}{*}{5} & \multirow{3}{*}{UNSWNB15} & \multirow{3}{*}{Normal: 77,500} & Without sampling & 0.7772 & 0.5085 & 0.5295 & 0.9654 & \\  & & Random Oversampling & 0.5757 & 0.6771 & 0.5895 & 0.9530 & \\  & & SMOTE & 0.5521 & 0.6764 & 0.5710 & 0.9528 & \\  & & DoS: 13,628 & ADASYN & 0.5376 & 0.6719 & 0.5592 & 0.9512 & \\  & & Reconnaissance: 11,656 & Random Undersampling & 0.4233 & 0.5633 & 0.3832 & 0.9307 & \\  & & Analysis: 2231 & AllRNN & 0.5543 & 0.4762 & 0.4952 & 0.9582 & \\  & & Backdoor: 1940 & TomekLinks & 0.7586 & 0.5059 & 0.5327 & 0.9646 & \\  & & Shellcode: 1259 & SMOTENN & 0.5152 & 0.6425 & 0.5114 & 0.9432 & \\  & & Worms: 145 & SMOTETomek & 0.5577 & 0.6609 & 0.5778 & 0.9555 & \\ \hline \hline \end{tabular}
\end{table}
Table 4: Impact of data imbalance on model performance.  
RNNs and LSTMs can increase computational costs in practical applications, which may become a bottleneck in intrusion detection tasks requiring high real-time performance [59].  
In recent years, the performance of deep learning in feature extraction has been significantly improved. For example, on the CIC-IDS2017 dataset, the PSO-CNN model achieved an accuracy of 99.45%. On the UNSW-NB15 dataset, the model achieved a detection rate of 99.75% [29]. This method combines the advantages of CNN and Particle Swarm Optimization (PSO) algorithms and can effectively capture the spatial features of data. The CNN-GRU-FF model, which combines CNN with GRU (Gated Recurrent Unit), has also been proposed for spatiotemporal feature extraction. Reference [7] indicated that the hybrid model outperforms the other seven algorithms in extracting features from the NSL-KDD and UNSW-NB15 datasets. The model in the literature combines CNN and GRU models to extract spatial and temporal features respectively, demonstrating its powerful ability to capture complex attack patterns.