Effectiveness of Random Forest in Network Intrusion Detection: A Comparative Experimental Study Using the NSL-KDD Dataset

Abstract

Detecting network intrusions stays a hard task in cybersecurity. Signature-based systems are common and mature, but they only react to known threats and cannot stop new or changed attack patterns. Researchers study machine learning methods like the Random Forest algorithm, but these methods struggle in real situations due to uneven data and overlapping features between good and bad traffic. This paper shares a reproducible test of the Random Forest algorithm on the NSL-KDD benchmark dataset. We examine binary intrusion classification performance both before and after applying SMOTE-based class balancing, and compare results against a Decision Tree baseline. Tests used Python and scikit-learn on a 22,544-sample test set from the NSL-KDD corpus. The best model, RF augmented with SMOTE, achieved 78.08% accuracy, 96.81% precision, 63.59% recall, and a 76.76% F1-score. A central finding is the persistent gap between precision and recall across all models. The paper analyzes this gap and attributes it to NSL-KDD's deliberate inclusion of novel attack types unseen during training, the lossy aggregation of four heterogeneous attack categories into a single class, and the inherent limitations of feature-vector-based classification without temporal context. This study concludes with concrete recommendations for future experimental designs aimed at closing this performance gap.