Random Forest-Based Network Intrusion Detection with Feature Selection and Class Balancing on UNSW-NB15 Traffic

Machine-learning intrusion detection is challenged by attacks resembling legitimate traffic and by class imbalance. This study evaluates Random Forest detection on the UNSW-NB15 dataset for five binary attack-versus-normal tasks: DoS, Exploit, Backdoor, Analysis, and Reconnaissance. Categorical attributes were label-encoded, features selected using mutual information, hyperparameters optimized by randomized search, decision thresholds tuned on validation data, and SMOTE applied to training data at a fixed target of 56,000 minority samples. SVM and KNN results are descriptive because the shared label-encoded representation precludes model-independent comparison. Without SMOTE, Random Forest achieved F1-scores of 0.9468 for DoS, 0.9504 for Exploit, 0.9839 for Backdoor, 0.9317 for Analysis, and 0.9720 for Reconnaissance. Fixed-SMOTE pipelines achieved 0.9539, 0.9516, 0.9668, 0.8370, and 0.9651, respectively. Thus, SMOTE improved DoS, marginally improved Exploit, and reduced performance for Backdoor, Analysis, and Reconnaissance. Confusion matrices showed fewer false positives and false negatives for DoS, while Analysis gained recall but produced substantially more false positives. These results compare separately optimized complete pipelines and do not isolate SMOTE’s effect. They characterize filtered target-attack-versus-normal streams, not operational mixed-attack traffic. Under this protocol, performance and precision–recall trade-offs were attack-dependent under the evaluated fixed-SMOTE experimental configuration, indicating that oversampling should be evaluated separately for each attack category.