## 1 Introduction  
With the network security risk increasing, implementing effective intrusion detection mechanisms has emerged as a critical strategy for safeguarding computer systems and network security [1; 2; 3; 4]. Conventional intrusion detection techniques primarily depend on pre-established rules or recognized attack attributes [5], such as employing string pattern matching to identify attack signatures and ascertain the presence of an intrusion. Nonetheless, these traditional methods exhibit limitations in detecting novel and unidentified attacks, relying heavily on expert experience [6; 7]. In contrast, machine learning techniques present notable benefits in intrusion detection. By acquiring knowledge from network data and attack samples, these methods enable the identification of unfamiliar malicious behaviors and signatures. Prior research [8; 9] has employed intelligent intrusion detection systems founded on machine learning approaches, which can detect attacks without any previous information. Subsequent investigations [10; 11; 12; 13] delve into the examination and comparison of various datasets frequently employed in network intrusion detection systems. The network data exhibits high dimensionality and category imbalance, posing challenges for traditional classification algorithms in extracting significant features. Moreover, the category imbalance further exacerbates the issue by causing low detection rates in models for certain categories. To address the challenges posed by high-dimensional data and class imbalance, researchers have made extensive efforts. Among these approaches, a combination of PCA and LDA feature extraction methods was explored in literature [14] to map the original feature set onto a lower-dimensional space, subsequently applied to the classifier. However, an alternative feature extraction framework based on stratification and dynamics was proposed in the literature [15]. While these methods have shown improvements following feature extraction, it is essential to note that feature extraction primarily focuses on secondary features after dimensionality reduction. In network intrusion detection, preserving the physical meaning of features in the original dataset post-dimensionality reduction becomes imperative. In comparison, feature selection exhibits certain advantages within the aforementioned domains. Reference [16] employed the linear correlation coefficient (FGLCC) algorithm and the cuttlefish algorithm (CFA) for data feature selection. Furthermore, a novel cross-correlation-based feature selection (CCFS) method was introduced in literature [17], which was validated across various classifiers. Conversely, to address the issue of dataset imbalance, literature [18] proposed a method that leverages the synthetic minority sampling algorithm (SMOTE) to balance the dataset. Additionally, literature [19] applied a combination of SMOTE, under-sampling clustering algorithms, and Gaussian mixture models for dataset manipulation. Numerous studies have indicated that performing feature engineering before data classification is essential for achieving optimal results. Meanwhile, within intrusion detection classification, the GBDT classifier exhibits distinct advantages over other classifiers. However, literature [20] analyzed the current implementation of GBDT, highlighting its strengths and weaknesses. Moreover, the effectiveness of CatBoost in classification and regression tasks was revealed. Nevertheless, this analysis also raises concerns regarding hyperparameter sensitivity and the criticality of hyperparameter tuning. Based on the analysis and study of references [21; 22], this paper comprehensively examines various intrusion detection techniques, providing valuable references for the author's work. It demonstrates that in the current Internet environment, on the one hand, the increasing popularity of the Internet has led to a rise in the number and complexity of network attacks, making emerging threats critical [23].