# Adversarial Hierarchical-Aware Edge Attention Learning Method for Network Intrusion Detection
## 6 Conclusions  
In this paper, we propose AH-EAT, an adversarial hierarchical-aware edge attention learning method. AH-EAT collaborates with an edge attention mechanism, a hierarchical detection framework, and an adversarial training module to construct a detection system with accuracy, efficiency, and robustness. It solves the defects of existing NIDSs in static feature aggregation, single-granularity detection, and adversarial vulnerability. We integrate edge features (such as flow protocol and interaction frequency) with an attention mechanism, adaptively distinguish key attack paths from noise edges, and effectively capture structures and feature patterns. It solves how traditional static aggregation strategies (such as mean/max pooling) cannot intelligently filter features, and lays a feature foundation for accurate detection. Through the hierarchical multi-grained detection, malicious and benign flows are quickly distinguished through coarse-grained detection. Then fine-grained attack detection is used to identify malicious flows. This framework breaks through the limitations of single-granularity detection, alleviating the problem of imbalanced attack class samples. It avoids the waste of resources of traditional methods of training from scratch. The adversarial training strategy is based on projected gradient descent (PGD), which generates adversarial samples of edge features. It forces the model to learn robust decision boundaries that are insensitive to perturbations, significantly improving the stability of the model in adversarial environments. Experiments have shown that AH-EAT has both accurate detection and strong robustness, providing a feasible technical solution for intrusion detection in complex network environments. Conceptualization, H.Y. and J.L. ; Methodology, H.Y. and L.D. ; Validation, H.Y. and J.L. ; Formal analysis, H.Y. ; Investigation, L.D. ; Resources, H.Y. ; Data curation, H.Y. ; Writing--original draft, H.Y. ; Writing--review & editing, H.Y., J.L., L.D. and Z.G. ; Visualization, Z.G. ; Supervision, Z.G. ; Project administration, B.F., Y.J. and Z.G. ; Funding acquisition, B.F., Y.J. and Z.G. All authors have read and agreed to the published version of the manuscript. * [1] [PERSON]; [PERSON]; [PERSON]; [PERSON] [PERSON]; [PERSON] A supervised intrusion detection system for smart home IoT devices. _IEEE Internet Things J._**2019**, \(6\), 9042-9053. [CrossRef]
* [2][PERSON]; [PERSON] An intelligent two-layer intrusion detection system for the Internet of Things. _IEEE Trans. Ind. Informatics_**2022**, _19_, 683-692. [CrossRef]
* [3] [PERSON]; [PERSON]; [PERSON]; [PERSON] [PERSON] Syrius: Synthesis of rules for intrusion detectors. _IEEE Trans. Reliab._**2021**, _71_, 370-381. [CrossRef]
* [4] [PERSON]; [PERSON]; [PERSON] A bayesian rule learning based intrusion detection system for the mqtt communication protocol. In Proceedings of the 16 th International Conference on Availability, Reliability and Security, Vienna, Austria, 17-20 August 2021; pp. 1-10. * [5] [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Performance analysis of machine learning algorithms in intrusion detection system: A review. _Procedia Comput. Sci._**2020**, _171_, 1251-1260. [CrossRef]
* [6] [PERSON]; [PERSON] Machine learning and deep learning methods for intrusion detection systems: A survey. _Appl. Sci._**2019**, \(9\), 4396. [CrossRef]
* [7] [PERSON]; [PERSON]; [PERSON] Learning neural representations for network anomaly detection. _IEEE Trans. Cybern._**2018**, _49_, 3074-3087. [CrossRef] [PubMed]
* [8] [PERSON]; [PERSON]; [PERSON] A method of few-shot network intrusion detection based on meta-learning framework. _IEEE Trans. Inf. Forensics Secur._**2020**, _15_, 3540-3552. [CrossRef]
* [9] [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] On-line anomaly detection with high accuracy. _IEEE/ACM Trans. Netw._**2018**, _26_, 1222-1235. [CrossRef]
* [10] [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] A few-shot class-incremental learning method for network intrusion detection.