## 1 Introduction  
With the rapid development of the internet, network security issues have become increasingly severe, leading to a surge in network intrusion incidents [1]. These intrusions can result in serious consequences, such as data breaches, privacy violations, financial losses, and even complete network paralysis [2]. Therefore, effective network intrusion detection has become a critical requirement for maintaining network security [3]. Research on network intrusion detection has primarily focused on feature extraction from network traffic, handling imbalanced datasets, and developing robust detection models [4]. Researchers have conducted extensive studies on network traffic feature extraction methods [5]. With the increasing complexity of cyber-attacks, network traffic has become more intricate, accompanied by redundant information and noisy data. Early traffic feature extraction relied on manual methods, resulting in low recognition accuracy [6]. [PERSON] et al. [7] proposed a Bootstrap-based homogeneous integrated feature selection method, which is more accurate than manual methods but is ineffective when dealing with highly correlated data. [PERSON] et al. [8] applied the Particle Swarm Optimization algorithm for feature selection, which considers feature correlations but suffers from latency in real-time data processing. Principal component analysis (PCA) does not require preset parameters or specific datasets, it reduces high-dimensional data to a lower-dimensional space by applying a linear transformation, achieving lower latency and reducing redundant features [9]. The PCA technique has achieved better results in other fields for processing redundant information and dirty data processing [10; 11; 12]. As a result, incorporating PCA techniques into intrusion detection was expected to produce beneficial outcomes. There is an imbalance in network traffic intrusion datasets, characterized by a predominance of normal instances and a minority of intrusion instances [13; 14]. Unbalanced datasets can adversely affect model training, degrading classification performance and leading to high false positives for specific minority class samples [15]. In order to solve this problem, numerous scholars have adopted oversampling techniques to handle imbalanced datasets. [PERSON] et al. [16] balanced datasets through the random oversampling method, which generates new data instances by replicating a few classes with the risk of overfitting. [PERSON] et al. [17] balanced the dataset via SMOTE linear interpolation, which solves the overfitting problem, but the generated instances overlap, resulting in low classifier accuracy. [PERSON] et al. [18] used the SMOTE-Tomek hybrid oversampling technique to eliminate Tomek links, which produced a new balanced dataset and mitigated the overlap problem. The SMOTE-Tomek technique's lack of consideration for the density of surrounding samples can lead to the generation of too many synthetic samples in dense areas, too few in sparse areas, and an overall uneven sample distribution. Adaptive synthetic sampling (ADASYN) [19] is an adaptive synthetic oversampling technique that generates samples in regions with low density, considers the density differences in the sample distribution, and can adjust the density of the generated samples according to the local density to reduce the risk of overfitting for a few classes, reduce the overlap rate of the samples, and improve the distribution uniformity of the dataset. Based on the above analysis, we used the PCA-ADASYN algorithm to process the network intrusion datasets in order to improve the recognition rate of minority classes, enhance the classification accuracy of the model, and strengthen its robustness. The current intrusion detection models are primarily based on machine learning algorithms, with Support Vector Machine (SVM) [20] being a typical approach. However, SVM was inefficient and struggled to handle nonlinear data effectively. [PERSON] et al. and [PERSON] et al.