# Adversarial Hierarchical-Aware Edge Attention Learning Method for Network Intrusion Detection
## 5 Experiments and Results
### Compare Robustness  
Adversarial robustness is a core indicator to measure whether a model can maintain stable performance under adversarial attacks. Tables 4 and 5 show the robustness performance of different models on the CIC-IDS2018 and ToN-IoT datasets, including clean sample accuracy (clean accuracy), adversarial sample robust accuracy (robust accuracy) and adversarial success rate (ASR).  
E-GCN achieves the highest clean accuracy (98.91%) on clean samples but collapses under adversarial attacks, with robust accuracy dropping to 53.50% and ASR reaching 46.50%, indicating severe sensitivity to adversarial perturbations. E-GraphSAGE performs better than E-GCN with a robust accuracy of 81.66% and ASR of 18.34%, though still showing significant degradation. Anomal-E performs worst, with robust accuracy as low as 11.97% and ASR as high as 88.03%, reflecting its inability to maintain classification ability in adversarial environments, likely due to poor feature extraction for IoT data using a self-supervised method. AH-EAT demonstrates overwhelming advantages on CIC-IDS2018: its clean accuracy (98.55%) is identical to robust accuracy, with an ASR of only 1.45%. This  
Figure 2: t-SNE visualization of ToN-IoT dataset embedding and false positive/negative analysis. **(a)** t-SNE visualization of coarse-grained detection with classifier decision boundaries. **(b)** t-SNE visualization of fine-grained detection. **(c)** Analysis of FPR, FNR, and TPR for each dataset.  
means the model's accuracy remains unchanged after adding adversarial perturbations, proving its strong resistance to adversarial attacks.  
As a dataset for low-resource IoT devices, ToN-IoT imposes stricter robustness requirements. E-GraphSAGE and E-GCN suffer drastic drops in robust accuracy to 19.58% and 30.64%, respectively, with ASR exceeding 60%, indicating that traditional GNNs struggle to defend against attacks in resource-constrained scenarios. In contrast, AH-EAT maintains consistent robust accuracy (84.38%) with an ASR of only 15.62%, which is far lower than peer models. This benefits from its hierarchical adversarial training, which suppresses the impact of perturbations on classification decisions while preserving original feature representations.  
AH-EAT constructs a multi-layer defense against adversarial perturbations through gradient alignment constraints and feature space robust regularization. On CIC-IDS2018, its ASR is only \(\frac{1}{32}\) of E-GCN, and on ToN-IoT, it reduces ASR by over 80% compared to E-GraphSAGE. This advantage is particularly critical for resource-constrained IoT scenarios, proving that AH-EAT can maintain stable detection performance under real-world attacks, providing a solid foundation for industrial deployment.  
The adversarial training module in AH-EAT also plays a key role in enhancing the model's robustness. By generating adversarial perturbations during training, the model has learned to focus on invariant features that are less susceptible to evasion attacks. This is evident from the model's consistent performance across different datasets, even when faced with adversarial examples.