## 2 Related Works
### Random Forest  
Random Forest is an ensemble learning algorithm primarily used for classification tasks [27]. It extends the bagging approach by incorporating feature randomness to con struct a forest of uncorrelated decision trees. The Random Forest algorithm combines the outputs of multiple decision trees to generate a final result. A Random Forest consists of a collection of decision trees, with each tree in the ensemble created by sampling data from a training set using a bootstrap sample. Before training, three key hyper-parameters need to be set: the node size, the number of features to be sampled, and the number of trees in the forest. The popularity of Random Forest stems from its ease of use and flexibility in handling both classification and regression problems. Unlike individual decision trees that consider all possible feature splits, Random Forest only selects a subset of features. The prediction process varies depending on the problem type. For regression tasks, the individual decision trees are averaged, while for classification tasks, the predicted class is determined by a majority vote based on the most frequent categorical variable [27]. In the field of intrusion detection systems, Random Forest has been widely utilized and tested with datasets such as KDD 99 [28,29], where it has been compared to SVM. It is also commonly employed with UNSW-NB15 [30,31] and CSE-CIC-IDS2018 [19]. Random Forest exhibits several advantages for intrusion detection, including its ability to handle high-dimensional and complex data, making it suitable for detecting anomalies in large datasets. It also performs well in the presence of noisy data, which is common in intrusion detection systems due to false alarms and other anomalies. However, Random Forest can be slow when processing large datasets, and it requires a significant amount of training data, posing a challenge when working with limited data in intrusion detection systems. Random Forest is an ensemble learning algorithm that combines the outputs of multiple decision trees to make predictions. It is widely used for both classification and regression tasks. The learning process of Random Forest involves the following steps:  
1 Bootstrapped Sampling: Random Forest starts by creating multiple subsets of the original training data through bootstrapped sampling. This sampling technique involves randomly selecting data points from the original dataset with replacement. Each subset is called a bootstrap sample and is used to train a separate decision tree;
2 Random Feature Selection: For each decision tree in the Random Forest, a random subset of features is selected. This process introduces randomness and reduces the correlation between trees. The number of features in the subset is typically determined by a hyper-parameter called \"max_features\". 3 Decision Tree Construction: Using the bootstrapped sample and the randomly selected feature subset, a decision tree is constructed for each subset. The construction follows the same steps as in the standalone decision tree learning process, including attribute selection, splitting, and recursive construction;
4 Voting or Averaging: Once all the decision trees are constructed, predictions are made by either voting (for classification tasks) or averaging (for regression tasks) the predictions of individual trees. In classification tasks, the class with the highest number of votes is chosen as the final prediction. In regression tasks, the mean or median value of the predictions is taken as the final prediction. Lets define a Random Forest ensemble with \(N\) decision trees. Each decision tree, denoted as \(T_{i}\), is constructed using a bootstrapped sample \(D_{i}\) from the original training dataset \(D\). Additionally, a random subset of features, denoted as \(F_{i}\), is selected for each tree.