# Adversarial Hierarchical-Aware Edge Attention Learning Method for Network Intrusion Detection
## 1 Introduction
In a realistic network, attack classes sometimes only need to know benign or malicious, and sometimes need to know the specific attack category. If you train from scratch every time, it leads to a lot of computing power and time wasted. Another emerging challenge is adversarial evasion. In recent years, adversarial attacks [18; 19; 20] have emerged in several research fields, such as in computer vision [19] and natural language processing [20]. Attackers can induce deep learning models to make incorrect predictions by injecting tiny perturbations that are imperceptible to the human eye into the input data. We envision that when dealing with real network intrusion detection, network attacks change their features to evade existing detection rules and intrusion detection methods. For example, obfuscation techniques have been used to generate variants from known attacks that evade rule-based detection methods [21]. Attackers often use techniques such as protocol camouflage (such as DNS covert tunnels) and flow feature obfuscation (such as modifying TCP window size) to construct adversarial network flow in order to evade detection systems. Such attacks can be regarded as edge feature perturbations on graph-structured data. Their goal is to modify the statistical features or protocol semantics of flow interactions so that malicious flow is misclassified as benign in the GNN model. Existing GNN-based intrusion detection methods (such as [13; 14]) generally have adversarial vulnerabilities. In the model training process, these methods [13; 14] assume that edge features are fixed and ignore the escape behavior of attackers actively perturbing features. Overall, to propose a robust and multi-grained GNN intrusion detection method, three key challenges must be addressed:  
* **Edge-aware aggregation**: Existing methods do not distinguish the importance of nodes and edges in aggregation and message passing, using static aggregation strategies (such as mean/max pooling). So, they cannot adaptively distinguish key attack paths from noise edges. * **Detection granularity**: Current methods only focus on anomaly classification and lack a hierarchical detection framework to balance efficiency (coarse-grained screening) and accuracy (fine-grained classification). * **Adversarial robustness**: Detectors must anticipate and resist graph-structured perturbations that attackers use to evade models. In this paper, we propose a novel combination of edge-aware attention with hierarchical coarse-to-fine detection under adversarial training, named AH-EAT, which systematically addresses the aforementioned challenges through three core mechanisms. The proposed method is able to learn an edge feature representation and exactly classify this edge into coarse-grained and fine-grained types with robustness against adversarial attacks. In detail, the method consists of three modules: an edge-based graph attention mechanism embedding module, a hierarchical multi-grained detection module, and an adversarial training module. The edge-based graph attention mechanism embedding module dynamically weights node-neighbor interactions by integrating edge features (e.g., flow protocols, interaction frequency) with attention mechanisms, adaptively distinguishing critical attack paths from noisy edges and capturing structural-semantic patterns vital for attack detection. The hierarchical multi-grained detection module is constructed with a two-stage pipeline: coarse-grained filtering of malicious flow followed by fine-grained classification of specific attack types, balancing detection efficiency and precision to overcome the limitation of single-granularity models. In the adversarial training module, a projected gradient descent (PGD)-based [22] adversarial training strategy is proposed, adding edge feature perturbations and graph structure noise during training.