In the rapid development of the Internet of Things (IoT) and large-scale distributed networks, Intrusion Detection Systems (IDS) face significant challenges in handling complex spatiotemporal features and addressing data imbalance issues. This article systematically reviews recent advancements in applying deep learning techniques in IDS, focusing on the core challenges of spatiotemporal feature extraction and data imbalance. First, this article analyzes the spatiotemporal dependencies of Convolutional Neural Networks (CNN) and Recurrent Neural Networks (RNN) in network traffic feature extraction and examines the main methods these models use to solve this problem. Next, the impact of data imbalance on IDS performance is explored, and the effectiveness of various data augmentation and handling techniques, including Generative Adversarial Networks (GANs) and resampling methods, in improving the detection of minority class attacks is assessed. Finally, the paper highlights the current research gaps and proposes future research directions to optimize deep learning models further to enhance the detection capabilities and robustness of IDS in complex network environments. This review provides researchers with a comprehensive perspective, helping them identify the challenges in the current field and laying a foundation for future research efforts.

In the rapid development of the Internet of Things (IoT) and large-scale distributed networks, Intrusion Detection Systems (IDS) face significant challenges in handling complex spatiotemporal features and addressing data imbalance issues. This article systematically reviews recent advancements in applying deep learning techniques in IDS, focusing on the core challenges of spatiotemporal feature extraction and data imbalance. First, this article analyzes the spatiotemporal dependencies of Convolutional Neural Networks (CNN) and Recurrent Neural Networks (RNN) in network traffic feature extraction and examines the main methods these models use to solve this problem. Next, the impact of data imbalance on IDS performance is explored, and the effectiveness of various data augmentation and handling techniques, including Generative Adversarial Networks (GANs) and resampling methods, in improving the detection of minority class attacks is assessed. Finally, the paper highlights the current research gaps and proposes future research directions to optimize deep learning models further to enhance the detection capabilities and robustness of IDS in complex network environments. This review provides researchers with a comprehensive perspective, helping them identify the challenges in the current field and laying a foundation for future research efforts.

With the explosive growth of the Internet of Things (IoT) and cloud-computing traffic, Intrusion Detection Systems (IDSs) have become a cornerstone of network security. However, modern traffic data often exhibits extreme class imbalance and long-tailed distributions, leading to persistently high miss rates for minority attack categories in Machine Learning (ML)-based IDSs. Conventional oversampling may introduce decision noise, whereas standard Generative Adversarial Networks (GANs) can suffer from training instability and mode collapse when modeling high-dimensional tabular traffic features. To address these challenges, we propose a high-fidelity traffic augmentation framework based on an Adaptive Hybrid-loss Conditional GAN (AH-CGAN). Specifically, AH-CGAN introduces an iteration-dependent adaptive gradient penalty (AGP) schedule to enforce the Lipschitz continuity constraint more effectively during training and incorporates a feature-matching objective to align intermediate critic representations between real and synthetic traffic. Experiments on the CIC-IDS2017 benchmark show that AH-CGAN generates distribution-consistent synthetic samples and that augmentation improves downstream detection across multiple classifiers. In particular, the weighted F1-score of Logistic Regression increases from 0.8237 to 0.8697 (Δ = +0.0460, i.e., +4.6%). Overall, the proposed approach enhances minority coverage in the feature space and can improve class separability, providing a practical solution for long-tailed IDS.