# Research on Intrusion Detection Based on an Enhanced Random Forest Algorithm
## 3 Cost-Sensitive Random Forest Algorithm
### Decision-Level Enhancement  
To address the issue of imbalanced classification, it is not only essential to set splitting criteria within each base classifier at the algorithmic level but also to incorporate cost-sensitive information into the voting process at the decision-tree leaf nodes at the decision level. In intrusion-detection data, the minority class (\(N\)) represents malicious access behavior, while the majority class comprises regular access behavior (\(P\)). In the model's decision voting phase, traditional methods fail to adequately consider sample weights. They treat each sample equally through majority voting, without accounting for the differing costs associated with different types of errors. In reality, the consequences of misclassifying malicious behavior as normal behavior involve various losses that differ from the cost of misclassifying normal access behavior.  
The introduction of cost-sensitive methods in the Random Forest algorithm primarily revolves around defining an appropriate cost matrix. This cost matrix allocates different error-classification costs to different classes, considering the costs associated with false positives and false negatives, with the aim of minimizing the total cost. Currently, cost matrices are typically obtained in two ways: through domain experts providing their expertise or by validating different cost matrices during the classifier training phase. However, in practical imbalanced classification scenarios, it may not be feasible to rely on expert knowledge alone to obtain a reliable cost matrix, especially when expert experience is limited. Therefore, employing different methods to validate the cost matrix is more practical.  
As the intersection point of sensitivity and specificity curves represents high sensitivity and specificity simultaneously, this paper determines the classification threshold by selecting the intersection point of the sensitivity and specificity curves. This threshold can be derived by using the sensitivity and specificity curve intersection method based on the validation set, allowing us to obtain the corresponding cost matrix:  
\[\begin{pmatrix}cost(P,P)=0&cost(P,N)=\textit{threshold}_{curve-cross}\\ cost(N,P)=\textit{threshold}_{curve-cross}&cost(N,N)=0\end{pmatrix}\]  
The cost matrix is incorporated into the classification decision-making process of the Random Forest algorithm, and the weighted voting of minority class samples is used to improve the minority class's voice in the final decision and reduce the excessive bias to the majority class. Therefore, in the decision-making process, the probability of leaf node \(t\) voting for a minority class is improved to the following:  
\[p(N|t)cost(N,P)>p(P|t)cost(P,N)\]  
\[p(N|t)cost(N,P)>(1-p(N|t))cost(P,N)\]  
\[p(N|t)>\frac{cost(P,N)}{cost(N,P)+cost(P,N)}\]  
The final category prediction result of Random Forest is obtained through the weighted majority voting of all trees, and the decision tree with higher weight is more sensitive to the unbalanced classification problem, and its majority voting decision stage has a greater decision weight.