Intrusion detection system combined enhanced random forest with SMOTE algorithm

Abstract Network security is subject to malicious attacks from multiple sources, and intrusion detection systems play a key role in maintaining network security. During the training of models, results generally have relatively large false rates due shortage data caused by imbalance. To address existing sample imbalance problem, this paper proposes algorithm based on enhanced random forest synthetic minority oversampling technique (SMOTE) algorithm. First, method used hybrid combining K-means clustering with SMOTE sampling increase number minor samples thus achieved balanced dataset, which features could be learned more effectively. Second, preliminary prediction were obtained using forest, then similarity matrix was correct voting processing analyzing type attacks. In paper, performance tested NSL-KDD dataset classification accuracy 99.72% set 78.47% test set. Compared other related papers, our has some improvement detection.