网络入侵检测系统（network intrusion detection systems, NIDS）对维护网络安全至关重要。然而，由于网络流量数据的复杂性和类不平衡问题，现有检测模型往往出现高误报率和对不同攻击类型的检测精度不足的现象。为了克服这些挑战，提出了一种基于拓扑数据分析（topological data analysis, TDA）的网络入侵检测不平衡学习方法，称为TopoSMOTE，用于生成新的少数类以平衡训练样本。TopoSMOTE的核心在于构建拓扑图来合成新样本。首先，该方法使用TDA映射网络流量数据中的空间关系和连接模式，并构建拓扑图。然后，基于拓扑图设计了一种少数类样本选择策略，通过低维映射空间中的距离度量选择具有拓扑关系的最近邻样本来合成新数据。本文在两个类不平衡的数据集上进行了实验。实验结果表明，与先进的过采样方法和入侵检测模型相比，TopoSMOTE方法具有更高的检测精度和更低的误报率。

Network intrusion detection systems (NIDS) are critical for maintaining cybersecurity. However, due to the complexity of network traffic data and the issue of class imbalance, existing detection models often exhibit high false alarm rates and insufficient detection accuracy for different types of attacks. To address these challenges, an imbalanced learning method for network intrusion detection, based on topological data analysis (TDA) and named TopoSMOTE, was proposed. This method aims to balance the training dataset by generating new minority class samples. The core of TopoSMOTE lied in constructing topological graphs to synthesize new samples. Firstly, the method used TDA to map the spatial relationships and connection patterns in network traffic data, forming a topological graph. Then, based on the topological graph, a minority class sample selection strategy was designed, which synthesized new data by selecting the nearest neighbor samples with topological relationships in a low-dimensional mapped space. Experiments were conducted on two imbalanced datasets. The experimental results show that the TopoSMOTE method achieves higher detection accuracy and lower false alarm rates compared to advanced oversampling methods and intrusion detection models.