## 3 Application of Proposed RF Algorithm for Intrusion Detection  
The proposed NID model combines the ensemble learning RF algorithm and the SMOTE to maintain high precision in prediction stability. The overall structure of the model is presented in Figure 5. The system classifies network traffic in three steps. In Step 1, data preprocessing is performed on the threat data set with the SMOTE scheme; this is done to augment the data of the minority class in the training set to balance the data. The balanced data points are then used for model training, during which the model classifies the potential attacks according to whether they are of normal traffic or malicious behavior. The raw data are analyzed and features are selected using the C4.5 algorithm; the algorithm reduces the number of input variables to both reduce the computational cost of the model and accelerate the classification performance of the model. In Step 2, RF ensemble learning is used to train component classifiers and aggregate the results of the component classifiers by randomly selecting subsets of the training data. A metaclassifier is trained with a majority voting approach to perform a threat classification of the observations. In Step 3, the NID model is evaluated in a large-scale network environment using two open-source data sets, UNSW-NB15 [15] and CSE-CIC-IDS2018 [16], on various threats. As illustrated in Figure 5, the threat analysis process comprises three subprocesses: data preprocessing (including resampling process and feature selection) model training and optimization, and performance evaluation for intrusion detection of network attacks as follows. Step 1. Data preprocessing  
Data preprocessing proceeds in the following steps: (1) encoding symbolic behavior (features) to numerical values, (2) normalising the scale, (3) resampling strategies for imbalanced data sets, and (4) feature selection. Step 1.1. Normalization  
Because the raw data are of various resolutions and ranges, the numerical data of each feature are normalized to a range of [\(-1\), \(1\)] using the following min-max formula. \[\text{d}=\frac{\text{d}-\text{min}_{\text{d}}}{\text{max}_{\text{d}}-\text{ min}_{\text{d}}}. \tag{3}\]  
Step 1.2. Resampling strategy  
To improve the situation of class imbalance, the user must modify the number of instances for minority class. In other words, if parts of class of the minority class were misclassified in the training process, it indicates the number of instances for this class needs to be augmented to increase the classification accuracy of model training. By applying  
Figure 5: Diagram of developed NID model. Formula (4), new synthetic samples (\(p_{i}\)) and the resampling magnification of the dataset (\(N\)) are generated randomly from minority class samples and their neighbors using oversampling operation. In the next section, we detail our evaluation of this RF in intrusion detection classification. Step 1.3. Feature selection  
Feature selection is the process of reducing the number of input variables to develop a predictive model to improve the performance of the model by reducing the computational costs of modelling. The process of obtaining a reduced set of features to create a predictive model requires experimentation and substantive knowledge about the problem at hand. To create a model, the subset of selected features in our data set was determined in accordance with C4.5 DT theory in which the values of attributes are represented by branches and attributes are arranged as nodes according to the data classification in DT learning. The C4.5 algorithm begins with the original set \(S\) as the root node. In each iteration of the solution procedure, the algorithm repeats itself through every unused attribute of the set \(S\) and process the information to calculate the \(IG(S)\) of that attribute. The attribute with the largest information gain is used to split \(S\) in the present iteration. Finally, the set \(S\) is split by the selected attribute to produce data subsets.