Enhancing Intrusion Detection Using Random Forest and SMOTE on the NSL‑KDD Dataset

Abstract

Intrusion Detection Systems (IDS) play a crucial role in identifying suspicious activities on computer networks. However, a major challenge in developing machine learning-based IDS is the issue of class imbalance, where attacks—being minority classes—are often overlooked by classification models. This study aims to construct an intrusion detection system based on the Random Forest algorithm integrated with the Synthetic Minority Over-sampling Technique (SMOTE) to address this problem. The NSL-KDD dataset is used for evaluation, with the data split into 80% for training and 30% for testing. Experiments include Random Forest-based feature selection and performance evaluation using accuracy, precision, recall, and F1-score metrics. The results show that the Random Forest–SMOTE combination achieves an accuracy of 99.78%, precision of 99.70%, recall of 99.88%, and an F1-score of 99.79%. The confusion matrix indicates a very low rate of false positives and false negatives. Additionally, selecting the most influential features such as src_bytes and dst_bytes improves model efficiency. Thus, the integration of Random Forest and SMOTE proves to be effective in enhancing detection sensitivity toward attacks without compromising model precision. This approach offers a significant contribution to the development of adaptive, accurate, and deployable IDS in real-world network environments.