# Adversarial Hierarchical-Aware Edge Attention Learning Method for Network Intrusion Detection
## 4 Methodology
### Adversarial Training Module  
In response to the defense requirements against escape attacks in network intrusion detection, this work proposes an edge feature perturbation generation framework based on projected gradient descent (PGD) [22]. PGD is adopted for its proven effectiveness as a universal first-order adversary, capable of generating strong adversarial examples that systematically expose model vulnerabilities. Unlike traditional nodes, focus on centric perturbation methods. Our approach leverages PGD to target edge features. Attackers often obfuscate protocol fields, port numbers, or flow timing to evade detection (e.g., DNS tunneling via modified UDP payloads or TCP flag order manipulation). Given the original edge feature matrix \(E\in R^{d_{e}}\), this paper generates adversarial perturbations \(\Delta\in R^{d_{e}}\) through multiple steps of iteration. The perturbed edge feature \(E^{adv}=E+\Delta\) maximizes the loss function of the detection model under the premise of satisfying the \(\ell_{\infty}\) norm constraint \(\|\Delta\|_{\infty}\leq e\). \[\Delta^{(l+1)}=\prod_{[-\epsilon,+e]}\left(\Delta^{(l)}+\alpha\cdot\text{sign }(\
abla_{\Delta^{(l)}}\mathcal{L}(f_{\theta}(\mathbf{E}+\Delta^{(l)}), \mathbf{Y}))\right)\]  
where \(\prod\) represents the projection operation, \(\alpha\) is the step size, and \(\mathcal{L}\) is the hierarchical cross-entropy loss function. The adversarial training formalized in Algorithm 2 alternates between adversarial perturbation crafting and model optimization throughout each training epoch. The process is initiated by generating edge feature perturbations through multi-step projected gradient descent (PGD). Starting from uniformly sampled noise within the prescribed \(\ell_{\infty}\) bound, the perturbation undergoes iterative refinement by ascending the gradient direction of the detection model's loss function. Following perturbation generation, the model parameters are updated using the adversarially perturbed graph features, thereby hardening the detector against evasion tactics while preserving topological relationships essential for contextual analysis. Our approach focuses on edge feature manipulation, such as payload content and inter-packet timing. These are key vectors for evasion in real-world attacks. By prioritizingedge features over static node attributes like IP geolocation, we ensure the training process aligns with realistic adversarial tactics. We preserve the topological integrity of the network graph, such as IP communication patterns, through edge-centric perturbation. This allows the model to learn how to distinguish malicious behaviors while retaining structural context. Additionally, the iterative nature of PGD is beneficial. For example, 10-20 steps are designed to capture incremental edge feature modifications in advanced attacks. For example, it can model APTs' gradual protocol shifting from HTTP to DNS. This capability forces the model to generalize across evolving evasion strategies. ```
0: Training graph \(G\), model \(f_{\theta}\), perturbation bound \(\epsilon\), step size \(\alpha\), iterations \(T\), total epochs \(N\), robust model parameters \(\theta\)
1:for epoch \(=1\) to \(N\)do
2: Generate adversarial examples:
3: Initialize \(\Delta^{(0)}\sim\mathcal{U}(-\epsilon,+\epsilon)\)
4:for\(t=1\) to \(T\)do
5: Compute gradient: \(\mathbf{g}\leftarrow\
abla_{\Delta}\mathcal{L}(f_{\theta}(G+\Delta^{(t-1)}))\)
6: Update perturbation: \(\Delta^{(t)}\leftarrow\Delta^{(t-1)}+\alpha\cdot\text{sign}(\mathbf{g})\)
7: Project to \(\ell_{\infty}\) ball: \(\Delta^{(t)}\leftarrow\text{Clip}_{[-\epsilon,+\epsilon]}(\Delta^{(t)})\)
8: Apply protocol constraints: \(\Delta^{(t)}\leftarrow\text{ProtocolProjection}(\Delta^{(t)})\)
9:endfor
10: Update model parameters:
11:\(\theta\leftarrow\theta-\eta\
abla_{\theta}\mathcal{L}(f_{\theta}(G+\Delta^{ (T)}))\)
12:endfor
```  
**Algorithm 2** Adversarial Training with PGD.