Network Attack Classification Using Random Forest and XGBoost Algorithms on UNSW-NB15 Dataset
The increasing frequency and sophistication of cyber threats have highlighted the need for effective Intrusion Detection Systems (IDS) capable of accurately identifying malicious network traffic. Traditional rule-based frameworks often face limitations in detecting previously unseen attacks and handling high-dimensional network datasets. To address this challenge, this study investigates the performance of Random Forest and Extreme Gradient Boosting (XGBoost) for binary network intrusion classification (normal vs. attack) using the benchmark UNSW-NB15 dataset. The proposed methodology incorporates data preprocessing, categorical feature encoding, and feature selection based on Random Forest feature importance to reduce data dimensionality and improve computational efficiency. Model performance was evaluated using accuracy, precision, recall, and F1-score, complemented by analyses of error distributions and computation time. The results show that both ensemble learning models achieved strong classification performance. Random Forest obtained the highest accuracy 99.59% and F1-score 98.38%, slightly outperforming XGBoost, which achieved an accuracy of 99.45% and an F1-score of 97.83%. In contrast, XGBoost demonstrated faster computational performance, while Random Forest provided slightly better predictive capability. These findings demonstrate the effectiveness of ensemble learning methods for intrusion detection on the UNSW-NB15 benchmark dataset and provide insights into selecting suitable machine learning models for IDS applications. However, further validation using additional datasets and real-world network environments is required to assess the generalizability of the proposed approach.