Abstract: The machine learning model has been widely used in network intrusion detection, but researchers pay more attention to model selection and parameter optimization, but rarely consider the impact of data imbalance, which often leads to poor detection effect of a small number of intrusion samples. To solve this problem, focusing on the data rebalancing algorithm of SMOTE(synthetic minority oversampling technique), taking the intrusion detection data set KDD99 as the original training set,a simple sampling method and SMOTE algorithm were used to generate the rebalancing training set. And then,a variety of machine learning models were used to perform 5 fold cross-validation for the original training set and the rebalanced training set respectively. Experimental results show that, compared with the original training set, the use of rebalancing training set modeling can improve the recognition accuracy and recall rate of the minor class samples by about 10%~20% without reducing or even improving the recognition effect of major class samples. Therefore, SMOTE algorithm can significantly improve network intrusion detection under unbalanced samples.