## 1 Introduction
\begin{table}
\begin{tabular}{c c c} \hline \hline  & **Features** & **Contributions and Experimental Results** \\ \hline SVM & Four support vector machine (SVM) & The agent and SVM were used to improve the detection precision of intrusive attacks for network intrusion detection (NID). \\ \hline Fuzzy multiclass SVM & A decision tree (DT) is constructed using fuzzy multiclass SVM in which each data class is assigned a fuzzy membership during training to reduce the effects of outliers and response time. & The combined fuzzy theory and multiclass SVM improved detection accuracy and reduced training time. \\ \hline SVM with PCA & The method is used for feature transformation into higher dimensions for determining the feature subset, after which the performance (in terms of detection rate and rate of false alarms) can be determined during testing. & The use of reduced features in training the support vector classifier accelerated the learning of normal and intrusive patterns. \\ \hline SVM with Belief theory & This method is a hybrid one wherein intrusive behavior is detected using the Dempster belief algorithm (DCA) and Dendritic Cell Algorithm and where data are classified with the SVM. & The detection rate from the joint use of DCA and SVM was less than 92\% (by contrast, the method proposed in the present paper reached 96\%). \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Machine learning approaches for network threat classification. poorly because it contains more parameters than the data can justify. Practically, ensemble learning algorithms, such as RF, can overcome overfitting in threat data in which RF corrects for overfitting from the DTs. Inspired by [PERSON]'s study [9], the present study proposes an RF-based ensemble learning algorithm associated with a uniform distribution resampling scheme for minority classes based on a Synthetic Minority Oversampling TEchnique (SMOTE) for NIDs. SMOTE manages the imbalance between threat classes in the data set in advance. Moreover, eliminate the irrelevant and unwanted features from the dataset in intrusion detection causes to possibly faster and more accurate detection. Consequently, feature selection scheme C4.5 is incorporated with RF to reduce the number of input variables to mitigate overfitting in developed predictive models. The performance of the proposed algorithm was demonstrated through experiments on the UNSW-NB15 data set [15] and CSE-CIC-IDS 2018 [16] for threat classification. A cross-validation scheme with a support vector classifier (SVC) was used for performance comparisons. In summary, the primary contributions of this study are as follows:  
* Multiclass threat classification was achieved using the RF method. Moreover, sources of open intrusion attacks in the UNSW-NB15 and CSE-CIC-IDS 2018 data sets were accurately classified, indicating our method's ability to classify threats as part of an NIDS;
* To improve the performance of random forests, the RF is incorporated with C4.5 algorithm to dimension reduction of training data that accelerates the training time of high-dimensional data in the model training;
* To improve data imbalanced situation, the resampling process of the SMOTE algorithm is proposed to reduce the skew in the distributions of classes by modifying the number of instances for minority class;
* The accuracy of the proposed algorithm was 99.81% for two-class classification of UNSW-NB15 and 87.64% for multiclass classification;
* The classification accuracy of intrusion detection was 99.98%% for two subcategories of CSE-CIC-IDS 2018 and 96.53% for six subcategories of classification accuracy;
* Compared with the classification accuracy of competing approaches on UNSW-NB15, such as [14; 17], the proposed RF-NID algorithm performed better in threat classification in cases where threats stemmed from multiple sources.