A Review of Deep Learning Applications in Intrusion Detection Systems: Overcoming Challenges in Spatiotemporal Feature Extraction and Data Imbalance
Source abstract
Abstract
In the rapid development of the Internet of Things (IoT) and large-scale distributed networks, Intrusion Detection Systems (IDS) face significant challenges in handling complex spatiotemporal features and addressing data imbalance issues. This article systematically reviews recent advancements in applying deep learning techniques in IDS, focusing on the core challenges of spatiotemporal feature extraction and data imbalance. First, this article analyzes the spatiotemporal dependencies of Convolutional Neural Networks (CNN) and Recurrent Neural Networks (RNN) in network traffic feature extraction and examines the main methods these models use to solve this problem. Next, the impact of data imbalance on IDS performance is explored, and the effectiveness of various data augmentation and handling techniques, including Generative Adversarial Networks (GANs) and resampling methods, in improving the detection of minority class attacks is assessed. Finally, the paper highlights the current research gaps and proposes future research directions to optimize deep learning models further to enhance the detection capabilities and robustness of IDS in complex network environments. This review provides researchers with a comprehensive perspective, helping them identify the challenges in the current field and laying a foundation for future research efforts.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Anomaly Detection Techniques and Applications · Internet Traffic Analysis and Secure E-voting
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Centre for Cyber Security, Faculty of Information Science and Technology (FTSM), Universiti Kebangsaan Malaysia (UKM), Bangi 43600, Selangor, Malaysia
College of Electronic Information and Artificial Intelligence, Yibin Vocational and Technical College, Yibin 644100, China
Funding
Yibin Vocational and Technical College research project · Yibin city science and technology project · Universiti Kebangsaan Malaysia Fundamental Research Grant Scheme (FRGS)
References (100+)
Show source-provided references
1. Abdullahi, M., Baashar, Y., Alhussian, H., Alwadain, A., Aziz, N., Capretz, L.F., and Abdulkadir, S.J. (2022). Detecting cybersecurity attacks in internet of things using artificial intelligence methods: A systematic literature review. Electronics, 11.10.3390/electronics11020198 ↗
2. A critical review of intrusion detection systems in the internet of things: Techniques, deployment strategy, validation strategy, attacks, public datasets and challenges10.1186/s42400-021-00077-7 ↗
3. Ren, J., and Sun, Z. (2022, January 12–14). GHM-DenseNet intrusion detection method based on GAN. Proceedings of the 2022 IEEE 4th International Conference on Civil Aviation Safety and Information Technology, ICCASIT 2022, Chengdu, China.10.1109/ICCASIT55263.2022.9986532 ↗
4. Huang, J., and Zhang, L. (2022, January 24–26). Network intrusion detection based on Dual-Encoder generative adversarial network. Proceedings of the EEI 2022—4th Int Conf Electron Eng Informatics, Guiyang, China.
5. Zuech, R., Hancock, J., and Khoshgoftaar, T.M. (2021, January 10–12). Detecting web attacks in severely imbalanced network traffic data. Proceedings of the 2021 IEEE 22nd International Conference on Information Reuse and Integration for Data Science, IRI 2021, San Diego, CA, USA.10.1109/IRI51335.2021.00043 ↗
6. Rahma, F., Rachmadi, R.F., Pratomo, B.A., and Purnomo, M.H. (2023, January 16–19). Assessing the effectiveness of oversampling and undersampling techniques for intrusion detection on an imbalanced dataset. Proceedings of the IEACon 2023—2023 IEEE Industrial Electronics and Applications Conference, Singapore.10.1109/IEACon57683.2023.10370430 ↗
7. CNN-GRU-FF: A double-layer feature fusion-based network intrusion detection system using convolutional neural network and gated recurrent units10.1007/s40747-023-01313-y ↗
8. DL-IDS: Extracting features using CNN-LSTM hybrid network for intrusion detection system10.1155/2020/8890306 ↗
9. A novel feature extraction methodology using Siamese convolutional neural networks for intrusion detection10.1186/s42400-020-00056-4 ↗
10. Unified deep learning approach for efficient intrusion detection system using integrated spatial–temporal features10.1016/j.knosys.2021.107132 ↗
11. Rao, Y.N., and Babu, K.S. (2023). An imbalanced generative adversarial network-based approach for network intrusion detection in an imbalanced dataset. Sensors, 23.10.3390/s23010550 ↗
12. Anomaly based network intrusion detection for IoT attacks using deep learning technique10.1016/j.compeleceng.2023.108626 ↗
13. CNN spatiotemporal features and fusion for surveillance video forgery detection10.1016/j.image.2020.116066 ↗
14. Spatiotemporal co-attention recurrent neural networks for human-skeleton motion prediction10.1109/TPAMI.2021.3050918 ↗
15. Sudyana, D., Lin, Y.D., Verkerken, M., Hwang, R.H., Lai, Y.C., D’hooge, L., and De Turck, F. (2024, January 16). Improving generalization of ML-Based IDS with Lifecycle-Based dataset, Auto-Learning features, and deep learning. Proceedings of the IEEE Transactions on Machine Learning in Communications and Networking, Arlington, VA, USA.10.1109/TMLCN.2024.3402158 ↗
16. Zhao, Z., Li, Z., Song, Z., Zhang, F., and Chen, B. (2024, January 20–23). RIDS: Towards advanced IDS via RNN model and programmable switches Co-Designed approaches. Proceedings of the IEEE INFOCOM 2024—IEEE Conference on Computer Communications, Vancouver, BC, Canada.10.1109/INFOCOM52122.2024.10621290 ↗
17. Jablaoui, R., and Liouane, N. (2024, January 15–17). Efficient RNN model for IoT intrusion detection systems. Proceedings of the 2024 International Conference on Control, Automation, and Diagnosis (ICCAD), Paris, France.10.1109/ICCAD60883.2024.10553939 ↗
18. Zhao, H., Cheng, A., Wang, Y., Wang, S., and Wang, H. (2024, January 7–9). CAN intrusion detection system based on data augmentation and improved Bi-LSTM. Proceedings of the 2024 IEEE Asia Pacific Conference on Circuits and Systems (APCCAS), Taipei, Taiwan.10.1109/APCCAS62602.2024.10808253 ↗
19. Surisetti, S., Bhavanam, S.N., Oruganti, V., and Devi, M.V. (2024, January 26–27). Intrusion detection system in internet of Things-Empowered cybersecurity by using various algorithms. Proceedings of the 2024 International Conference on Data Science and Network Security (ICDSNS), Tiptur, India.10.1109/ICDSNS62112.2024.10691223 ↗
20. Jayant, P., Shetty, M.P., Jeevan, S., Moharir, M., and Kumar, A. (2024, January 24–28). Intrusion detection in network traffic using LSTM and deep learning. Proceedings of the 2024 15th International Conference on Computing Communication and Networking Technologies (ICCCNT), Kamand, India.10.1109/ICCCNT61001.2024.10724486 ↗
21. Ramkumar, K., Alzubaidi, L.H., Malathy, V., Venkatesh, T., and Kruthika, C.G. (2024, January 23–24). Intrusion detection system in wireless sensor networks using modified recurrent neural network with Long Short-Term memory. Proceedings of the 2024 International Conference on Integrated Circuits and Communication Systems (ICICACS), Raichur, India.10.1109/ICICACS60521.2024.10498333 ↗
22. Su, X., Tian, T., Cai, L., Ye, B., and Xing, H. (2022, January 17–19). A CVAE-GAN-Based approach to process imbalanced datasets for intrusion detection in marine meteorological sensor networks. Proceedings of the 2022 IEEE Intl Conf on Parallel & Distributed Processing with Applications, Big Data & Cloud Computing, Sustainable Computing & Communications, Social Computing & Networking, Melbourne, Australia.10.1109/ISPA-BDCloud-SocialCom-SustainCom57177.2022.00032 ↗
23. An ensemble deep learning based IDS for IoT using Lambda architecture10.1186/s42400-022-00133-w ↗
24. Musafer, H., Abuzneid, A., Faezipour, M., and Mahmood, A. (2020). An enhanced design of sparse autoencoder for latent features extraction based on trigonometric simplexes for network intrusion detection systems. Electronics, 9.10.3390/electronics9020259 ↗
25. Toward constructing a balanced intrusion detection dataset10.54153/sjpas.2020.v2i3.86 ↗
26. A survey on generative adversarial networks for imbalance problems in computer vision tasks10.1186/s40537-021-00414-0 ↗
27. Machine learning in IoT security: Current solutions and future challenges10.1109/COMST.2020.2986444 ↗
28. A survey of machine and deep learning methods for internet of things (IoT) security10.1109/COMST.2020.2988293 ↗
29. Feature extraction and artificial intelligence-based intrusion detection model for a secure internet of things networks
30. Deep convolutional generative adversarial networks for traffic data imputation encoding time series as images10.1016/j.ijtst.2021.10.007 ↗
31. Lipinski, P., Brzychczy, E., and Zimroz, R. (2020). Decision tree-based classification for planetary gearboxes’ condition monitoring with the use of vibration data in multidimensional symptom space. Sensors, 20.10.3390/s20215979 ↗
32. Enhanced deep learning intrusion detection in iot heterogeneous network with feature extraction
33. Liu, Z., Du, F., Li, W., Liu, X., and Zou, Q. (2020). Non-local spatial and temporal attention network for video-based person re-identification. Appl. Sci., 10.10.3390/app10155385 ↗
34. Fatani, A., Dahou, A., Al-Qaness, M.A., Lu, S., and Elaziz, M.A. (2022). Advanced feature extraction and selection approach using deep learning and aquila optimizer for iot intrusion detection system. Sensors, 22.10.3390/s22010140 ↗
35. Sequence feature extraction-based APT attack detection method with provenance graphs10.1360/SSI-2021-0252 ↗
36. Aboaoja, F.A., Zainal, A., Ghaleb, F.A., Al-Rimy, B.A.S., Eisa, T.A.E., and Elnour, A.A.H. (2022). Malware detection issues, challenges, and future directions: A survey. Appl. Sci., 12.10.3390/app12178482 ↗
37. Model robustness optimization method using GAN and feature pyramid
38. Wongvorachan, T., He, S., and Bulut, O. (2023). A comparison of undersampling, oversampling, and SMOTE methods for dealing with imbalanced classification in educational data mining. Information, 14.10.3390/info14010054 ↗
39. Sapre, S., Islam, K., and Ahmadi, P. (2021, January 9–12). A comprehensive data sampling analysis applied to the classification of rare IoT network intrusion types. Proceedings of the 2021 IEEE 18th Annual Consumer Communications & Networking Conference CCNC, Las Vegas, NV, USA.10.1109/CCNC49032.2021.9369617 ↗
40. Saikam, J., and Koteswararao, C. (2023, January 14–15). A Comprehensive review of machine learning and deep learning techniques for addressing class imbalance issues in network intrusion detection systems. Proceedings of the 2023 6th International Conference on Recent Trends in Advance Computing, ICRTAC 2023, New Delhi, India.10.1109/ICRTAC59277.2023.10480850 ↗
41. Deep regularization mechanism for combating class imbalance problem in intrusion detection system for defending DDoS attack in SDN10.3844/jcssp.2023.334.344 ↗
42. Mbow, M., Koide, H., and Sakurai, K. (2021, January 23–26). An intrusion detection system for imbalanced dataset based on deep learning. Proceedings of the 2021 9th International Symposium on Computing and Networking, CANDAR 2021, Fukuoka, Japan.10.1109/CANDAR53791.2021.00013 ↗
43. Joloudari, J.H., Marefat, A., Nematollahi, M.A., Oyelere, S.S., and Hussain, S. (2023). Effective class-imbalance learning based on SMOTE and convolutional neural networks. Appl. Sci., 13.10.3390/app13064006 ↗
44. Huang, Y., Liu, J., Xiang, X., Wen, P., Wen, S., Chen, Y., and Zhang, Y. (2024). Malware Identification Method in Industrial Control Systems Based on Opcode2vec and CVAE-GAN. Sensors, 24.10.3390/s24175518 ↗
45. A novel multi-module integrated intrusion detection system for high-dimensional imbalanced data10.1007/s10489-022-03361-2 ↗
46. A multi-step APT attack detection using hidden Markov models by molecular magnetic sensors10.1007/s11082-023-05905-3 ↗
47. Few-Shot learning for discovering anomalous behaviors in edge networks
48. Feature extraction for machine learning-based intrusion detection in IoT networks10.1016/j.dcan.2022.08.012 ↗
49. Zhao, D.H., Qiu, Z., Jiang, Y., Zhu, X., Zhang, X., and Tao, Z. (2024). A depthwise separable CNN-based interpretable feature extraction network for automatic pathological voice detection. Biomed. Signal Process. Control, 88.10.1016/j.bspc.2023.105624 ↗
50. A new AI-based approach for automatic identification of tea leaf disease using deep neural network based on hybrid pooling10.1016/j.heliyon.2024.e26465 ↗
51. Prosperous human gait recognition: An end-to-end system based on pre-trained CNN features selection10.1007/s11042-020-08928-0 ↗
52. A deep CNN-LSTM-Based feature extraction for Cyber-Physical system monitoring
53. Detection of sarcastic sentiment analysis in tweets using lstm with improved attention based feature extraction
54. Design of english teaching speech recognition system based on LSTM network and feature extraction10.1007/s00500-023-08550-w ↗
55. Feature extraction based on word embedding models for intrusion detection in network traffic
56. Zou, Q., and Guan, W. (2022, January 19–21). Intrusion detection method based on wasserstein generative adversarial network. Proceedings of the 2022 2nd International Conference on Frontiers of Electronics, Information and Computation Technologies, ICFEICT 2022, Wuhan, China.10.1109/ICFEICT57213.2022.00109 ↗
57. Wang, C., Wang, W., Dong, J., and Guo, G. (2021, January 12–14). Research on network intrusion detection yechnology based on DCGAN. Proceedings of the 2021 IEEE 5th Advanced Information Technology, Electronic and Automation Control Conference (IAEAC), Chongqing, China.
58. Li, F., Ma, W., Li, H., and Li, J. (2022, January 9–11). Improving intrusion detection system using ensemble methods and over-sampling technique. Proceedings of the 2022 4th International Academic Exchange Conference on Science and Technology Innovation (IAECST), Guangzhou, China.10.1109/IAECST57965.2022.10062178 ↗
59. Zhang, J., and Zhao, Y. (2021, January 25–27). Research on intrusion detection method based on generative adversarial network. Proceedings of the 2021 International Conference on Big Data Analysis and Computer Science (BDACS), Kunming, China.10.1109/BDACS53596.2021.00065 ↗
60. STLGBM-DDS: An efficient data balanced DoS detection system for wireless sensor networks on big data environment10.1109/ACCESS.2022.3202807 ↗
61. Nuclear atypia grading in breast cancer histopathological images based on CNN feature extraction and LSTM classification10.1049/cit2.12061 ↗
62. Bi, J., Xu, L., Yuan, H., and Zhang, J. (2023, January 1–4). Web traffic anomaly detection using a hybrid spatio-temporal neural network. Proceedings of the 2023 IEEE International Conference on Systems, Man, and Cybernetics (SMC), Honolulu, Oahu, HI, USA.10.1109/SMC53992.2023.10394549 ↗
63. Mohan Das, R., Arun Kumar, U., Gopinath, S., Gomathy, V., Natraj, N.A., Anushkannan, N.K., and Balashanmugham, A. (2023). A novel deep learning-based approach for detecting attacks in social IoT. Soft Comput., 1–11.10.1007/s00500-023-08389-1 ↗
64. Machine learning-based intrusion detection: Feature selection versus feature extraction10.1007/s10586-023-04089-5 ↗
65. Xing, L., Wang, K., Wu, H., Ma, H., and Zhang, X. (2023). Intrusion detection method for internet of vehicles based on parallel analysis of spatio-temporal features. Sensors, 23.10.3390/s23094399 ↗
66. Ensemble classification for intrusion detection via feature extraction based on deep Learning10.1007/s00500-021-06067-8 ↗
67. Selective ensemble learning for soft sensor development based on deep learning for feature extraction and multi-objective optimization for ensemble pruning
68. Sayegh, H.R., Dong, W., and Al-madani, A.M. (2024). Enhanced intrusion detection with LSTM-Based model, feature selection, and SMOTE for imbalanced data. Appl. Sci., 14.10.3390/app14020479 ↗
69. Real and fake channel: GAN-based wireless channel modeling and generating10.1016/j.phycom.2023.102214 ↗
70. Machine learning-based network intrusion detection for big and imbalanced data using oversampling, stacking feature embedding and feature extraction10.1186/s40537-024-00886-w ↗
71. A method of hierarchical feature fusion and connected attention architecture for pavement crack detection10.1109/TITS.2022.3147669 ↗
72. Smart-DNN+: A memory-efficient neural networks compression framework for the model inference10.1145/3617688 ↗
73. Tan, Z., Tan, S.H., Lambrechts, J.H., Zhang, Y., Wu, Y., and Ma, K. (2021, January 25–30). A 400MHz NPU with 7.8TOPS2/W high-performance guaranteed efficiency in 55nm for multi-mode pruning and diverse quantization using pattern-kernel encoding and reconfigurable MAC units. Proceedings of the Custom Integrated Circuits Conference, San Diego, CA, USA.10.1109/CICC51472.2021.9431519 ↗
74. Olatinwo, D.D., Abu-Mahfouz, A., Hancke, G., and Myburgh, H. (2023). IoT-Enabled WBAN and machine learning for speech emotion recognition in patients. Sensors, 23.10.3390/s23062948 ↗
75. A self-attention based contrastive learning method for bearing fault diagnosis10.1016/j.eswa.2023.121645 ↗
76. A review of various semi-supervised learning models with a deep learning and memory approach10.1007/s42044-018-00027-6 ↗
77. Chai, W., and Wang, G. (2022). Deep vision multimodal learning: Methodology, benchmark, and trend. Appl. Sci., 12.10.3390/app12136588 ↗
78. Source data-absent unsupervised domain adaptation through hypothesis transfer and labeling transfer
79. Tran, D., Bourdev, L., Fergus, R., Torresani, L., and Paluri, M. (2015, January 7–13). Learning spatiotemporal features with 3D convolutional networks. Proceedings of the 2015 IEEE International Conference on Computer Vision (ICCV), Santiago, Chile.10.1109/ICCV.2015.510 ↗
80. Computed tomography-based 3D convolutional neural network deep learning model for predicting micropapillary or solid growth pattern of invasive lung adenocarcinoma10.1007/s11547-024-01800-3 ↗
81. Li, Y.F., Liu, C.Y., Yan, L., Li, J., Plaza, A., and Li, B. (August, January 28). A new spatio-temporal fusion method for remotely sensed data based on convolutional neural networks. Proceedings of the 2019 IEEE International Geoscience and Remote Sensing Symposium (IGARSS), Yokohama, Japan.10.1109/IGARSS.2019.8898524 ↗
82. Nakagawa, A., Sukigara, M., and Benga, O. (2003). The temporal relationship between reduction of early imitatitve responses and the development of attention mechanisms. BMC Neurosci., 4.10.1186/1471-2202-4-33 ↗
83. Extrapolation of affective norms using transformer-based neural networks and its application to experimental stimuli selection10.3758/s13428-023-02212-3 ↗
84. Moro, G., Ragazzi, L., Valgimigli, L., Frisoni, G., Sartori, C., and Marfia, G. (2023). Efficient memory-enhanced transformer for long-document summarization in low-resource regimes. Sensors, 23.10.3390/s23073542 ↗
85. Adaptive spatio-temporal graph neural network for traffic forecasting10.1016/j.knosys.2022.108199 ↗
86. Song, J., Son, J., Seo, D.H., Han, K., Kim, N., and Kim, S.W. (2022, January 17–21). ST-GAT: A spatio-temporal graph attention network for accurate traffic speed prediction. Proceedings of the 31st ACM International Conference on Information and Knowledge Management, Atlanta, GA, USA.10.1145/3511808.3557705 ↗
87. Khlaisamniang, P., and Phoomvuthisarn, S. (2023, January 10–12). ST-CopulaGNN: A multi-view spatio-temporal graph neural network for traffic forecasting. Proceedings of the 35th International Conference on Scientific and Statistical Database Management, Los Angeles, CA, USA.10.1145/3603719.3603740 ↗
88. Enhancing intrusion detection in IIoT: Optimized CNN model with multi-class SMOTE balancing
89. Balla, A., Habaebi, M.H., Elsheikh, E.A., Islam, M.R., and Suliman, F.M. (2023). The effect of dataset imbalance on the performance of SCADA intrusion detection systems. Sensors, 23.10.3390/s23020758 ↗
90. Impact of data balancing and feature selection on machine learning-based network intrusion detection
91. Intrusion detection system after data augmentation schemes based on the VAE and CVAE10.1109/TR.2022.3164877 ↗
92. Abedzadeh, N., and Jacobs, M. (2023). A reinforcement learning framework with oversampling and undersampling algorithms for intrusion detection system. Appl. Sci., 13.10.3390/app132011275 ↗
93. Benaddi, H., Jouhari, M., Ibrahimi, K., Ben Othman, J., and Amhoud, E.M. (2022). Anomaly detection in industrial IoT using distributional reinforcement learning and generative adversarial networks. Sensors, 22.10.3390/s22218085 ↗
94. A method for network intrusion detection based on GAN-CNN-BiLSTM
95. IGAN-IDS: An imbalanced generative adversarial network towards intrusion detection system in ad-hoc networks10.1016/j.adhoc.2020.102177 ↗
96. Imbalanced data classification: A KNN and generative adversarial networks-based hybrid approach for intrusion detection10.1016/j.future.2022.01.026 ↗
97. Internet of things applications, security challenges, attacks, intrusion detection, and future visions: A systematic review10.1109/ACCESS.2021.3073408 ↗
98. Wan, W., Peng, Z., Wei, J., Zhao, J., Long, C., and Du, G. (2021, January 25–27). An effective integrated intrusion detection model based on deep neural network. Proceedings of the 2021 International Conference on Computer Engineering and Application (ICCEA), Kunming, China.10.1109/ICCEA53728.2021.00037 ↗
99. Kk, S., Shrivastava, S., and Sangeetha, V. (2022, January 13–14). Anomaly-based intrusion detection using GAN for industrial control systems. Proceedings of the 2022 10th International Conference on Reliability, Infocom Technologies and Optimization (Trends and Future Directions) (ICRITO), Noida, India.10.1109/ICRITO56286.2022.9964997 ↗
100. Effect of balancing data using synthetic data on the performance of machine learning classifiers for intrusion detection in computer networks10.1109/ACCESS.2022.3205337 ↗