# Research on Intrusion Detection Based on an Enhanced Random Forest Algorithm
## 4 Experimental Verification and Result Analysis  
### Experimental Setup  
(1) Experimental environment setting  
The experimental hardware environment is Windows 10 (American Transnational Technologies, Redmond, WA, USA), Intel Core i7-700 [EMAIL_ADDRESS] GHz CPU (Intel Corporation, Santa Clara, CA, USA), GeForce GTX1050 Ti GPU (NVIDIA, Santa Clara, CA, USA),  
Figure 2: Intrusion-detection algorithm process. and 16 GB RAM (Lenovo, Tianjin, China). The software environment uses VScode1.80 and Python 3.7.9. (2) Dataset selection  
Classic intrusion-detection datasets, such as KDD Cup 1999, NSL-KDD, and DARPA [35], are well-known, but they often suffer from high redundancy and duplicate samples and may not fully represent modern network environments with emerging attack behaviors. The UNSW-NB15 dataset [36], developed by the University of New South Wales, stands out as a network-intrusion-detection dataset with diversity and authenticity. It provides real and complex intrusion-detection scenarios, offering insights into network attacks and threats in real-world environments. The dataset has been used extensively and has been introduced into a different class of network traffic classification system based on multiple artificial intelligence techniques to study network traffic to ensure network security using artificial intelligence [37] and into a Machine Learning Based Ensemble Intrusion Detection (MLEID) methodology to minimize malicious behaviors in botnet attacks related to the Message Queuing Telemetry Transport (MQTT) and Hyper-Text Transfer Protocol (HTTP) protocols by minimizing the use of artificial intelligence in the detection of network intrusions. Protocol (HTTP) functions by minimizing malicious behavior in botnet attacks related to message queue telemetry transfer (MQTT) and the Hyper-Text Transfer Protocol (HTTP) [38], all of which demonstrate the dataset's ability to improve and increase the accuracy and reliability of network intrusion detection systems. Hence, utilizing the UNSW-NB15 dataset enables the evaluation of classifiers in realistic and intricate network environments. Detailed distribution information for this dataset is presented in Table 1.  
To address the challenges of high dimensionality and class imbalance in the dataset, this paper takes a two-pronged approach. Firstly, it introduces the Bald Eagle Search (BES) algorithm to optimize multiple parameters of the Kernel Principal Component Analysis (KPCA) algorithm. This optimization process results in an enhanced version of KPCA (B-KPCA), which effectively eliminates redundant data, reduces dimensionality, and improves dataset usability. Secondly, the paper integrates the concept of cost sensitivity with the Random Forest algorithm, enhancing sensitivity towards minority classes. This combination not only reduces the training time of the detection model but also enhances the accuracy of detecting intrusion behavior within the minority class. By adopting these two strategies, the paper aims to create a more efficient and effective intrusion detection system, capable of handling the challenges posed by high-dimensional and imbalanced datasets. \begin{table}
\begin{tabular}{c c c} \hline \hline  & **UNSW-NB15** & \\  & **Testing and Training Sets** & \\ \hline Normal & 56,000 & 37,000 \\ Anallysis & 2000 & 677 \\ Backdoor & 1746 & 583 \\ Dos & 12,264 & 4089 \\ Exploits & 33,393 & 11,132 \\ Fuzzers & 18,184 & 6062 \\ Generic & 40,000 & 18,871 \\ Reconnaissance & 10,491 & 3496 \\ Shellcode & 1133 & 378 \\ Worms & 130 & 44 \\ Total & 175,341 & 82,332 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Information in UNSW-NB15 training and testing. (3) Selection of Evaluation Metrics  
In the context of classification problems, classification outcomes can be categorized into two main results: correct or incorrect. These outcomes can be further classified into four distinct scenarios, as outlined in Table 2:  
_TPs_ (True Positives): The model correctly detects attack traffic.