# Adversarial Hierarchical-Aware Edge Attention Learning Method for Network Intrusion Detection
## 5 Experiments and Results
### Ablation Study  
The ablation experiment removes the core modules (attention, hierarchical detection framework, adversarial training) to quantify the independent contribution of each component to the model performance (accuracy, robustness) and reveal the synergy between modules. By comparing the performance of the complete model with the variant model, the necessity of each module design and its unique value in complex tasks are verified, providing a theoretical basis for model optimization. Tables 6 and 7 show the results on the BoT-IoT (fine-grained) and UNSW-NB15 (coarse-grained) datasets, respectively. \begin{table}
\begin{tabular}{l c c c} \hline \hline \multirow{2}{*}{**Model**} & \multicolumn{3}{c}{**Performance (\%)**} \\ \cline{2-4}  & **Clean Accuracy** & **Robust Accuracy** & **ASR** \\ \hline E-GraphSAGE [13] & 98.48 & 81.66 & 18.34 \\ E-GCN & 98.91 & 53.50 & 46.50 \\ Anomal-E [14] & 97.83 & 11.97 & 88.03 \\ AH-EAT & 98.55 & 98.55 & 1.45 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Comparison of adversarial robustness performance on CIC-IDS2018. \begin{table}
\begin{tabular}{l c c c} \hline \hline \multirow{2}{*}{**Model**} & \multicolumn{3}{c}{**Performance (\%)**} \\ \cline{2-4}  & **Clean Accuracy** & **Robust Accuracy** & **ASR** \\ \hline E-GraphSAGE [13] & 82.37 & 19.58 & 80.42 \\ E-GCN & 80.67 & 30.64 & 69.36 \\ AH-EAT & 84.38 & 84.38 & 15.62 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Comparison of adversarial robustness performance on ToN-IoT. The three models are designed as follows:  
* **AH-EAT-NA** (removes attention mechanism). This variant removes the attention mechanism and uses the mean aggregation of neighbor features instead. The goal is to verify the key role of hierarchical attention in the fusion of graph structure features. By comparing the original model, whether mean aggregation leads to a decrease in feature discrimination (such as ignoring the structural information of key nodes) is observed. Therefore, it clarifies the irreplaceable role of the attention mechanism in screening high-value neighbor features and suppressing noise interference. * **AH-EAT-NH** (remove hierarchical detection framework). This variant removes the hierarchical framework of \"coarse-grained detection \(\rightarrow\) fine-grained classification\" and directly performs multi-classification on all samples. Its core goal is to verify the dual improvement of hierarchical detection on efficiency and accuracy: whether the coarse-grained stage can effectively filter normal samples to reduce the computational load, and whether the fine-grained stage can alleviate the category imbalance problem through hierarchical decision-making. * **AH-EAT-NADV** (remove adversarial training). This variant turns off the adversarial training module and only uses the original clean data for training, aiming to verify the core impact of adversarial training on model robustness. By comparing the performance under adversarial samples (such as ASR, robust accuracy), it quantifies the cornerstone role of adversarial training in resisting perturbations. It enhances the robustness of feature space and reveals its decisive impact on the stability of the model in real attack scenarios. Table 6 shows the effects on a fine-grained dataset. Attention mechanism (AH-EAT-NA): After removal, the F1-score dropped by 1.16% (83.84%\(\rightarrow\)82.68%), but accuracy unexpectedly increased by 0.8% (81.46%\(\rightarrow\)82.26%). This shows that although mean aggregation improves overall accuracy, it weakens the ability to capture hidden attack features (such as the time series pattern of DNS tunnels). Its ASR decreased by 1.88% (18.85%\(\rightarrow\)17.97%), reflecting that the attention mechanism may introduce slight vulnerabilities, so the effect of the attention mechanism is limited in a small-scale dataset such as BoT-IoT. Hierarchical detection framework (AH-EAT-NH): direct multi-classification caused the F1-score to plummet by 14.75% (83.84%\(\rightarrow\)69.09%), and ASR increased by 2.97% (18.85%\(\rightarrow\)21.82%).