# Adversarial Hierarchical-Aware Edge Attention Learning Method for Network Intrusion Detection
## 4 Methodology
### Edge Attention Mechanism Embedding  
GNNs have been successfully applied in various application domains. However, these approaches mainly focus on node features for message propagation and are currently unable to consider edge features for edge classification. Therefore, we propose an edge attention mechanism that integrates edge-specific semantics into the message-passing process, enabling the model to dynamically weigh node-neighbor interactions while incorporating edge features. The attention mechanism provides a new idea for graph modeling by dynamically assigning node-edge interaction weights. For example, hierarchical atten  
Figure 1: Proposed AH-EAT NIDS pipeline. A given NIDS dataset is pre-processed into training and testing graphs (**left**). The training graph is used to generate an adversarial graph, then train the AH-EAT model (**middle**). Finally, the testing graph can be detected in coarse-grained and fine-grained scales (**right**). tion network (HAN) [29] uses predefined meta-paths to capture the semantic information of heterogeneous graphs (such as the \"author-paper-conference\" relationship in academic networks), but its performance is highly dependent on manually designed meta-paths and is difficult to adapt to the variability and concealment of network attack patterns (such as the unknown propagation path of zero-day attacks). The core of our approach is a two-stage process: attention coefficient calculation and edge-aware message aggregation, as formalized in Algorithm 1. \[\mathbf{z}_{uv}\leftarrow\text{CONCAT}(\mathbf{h}_{u}^{(k-1)},\mathbf{h}_{v}^{ (k-1)})\]  
\[\alpha_{uv}\leftarrow\text{LeakyReLU}(\mathbf{W}_{\text{attn}}\mathbf{z}_{uv})\]  
where \(\mathbf{h}_{u}^{(k-1)}\) and \(\mathbf{h}_{v}^{(k-1)}\) are the node features of \(u\) and \(v\) at the \((k-1)\)-th layer. This vector is then fed into a linear layer with a LeakyReLU activation to generate the attention coefficient. \(\mathbf{W}_{\text{attn}}\) is a weight matrix that parameterizes the attention mechanism, enabling the model to learn the importance of node pairs adaptively. ```
0: Graph \(G(V,E)\)
0: Node features \(\mathbf{H}^{(0)}=\{\mathbf{h}_{v}^{(0)}\in\mathbf{R}^{d_{v}}\,\forall v\in V\}\)
0: Edge features \(\mathbf{E}=\{\mathbf{e}_{uv}\in\mathbf{R}^{d_{v}},\forall(u,v)\in E\}\)
0: Weight matrices \(\mathbf{W}_{\text{msg}}\), \(\mathbf{W}_{\text{apply}}\), \(\mathbf{W}_{\text{attn}}\)
0: Nonlinearity \(\sigma\)
0: Edge embeddings \(\mathbf{Z}_{uv}^{(K)}\), Node embeddings \(\mathbf{Z}_{v}\)
1:for layer \(k=1\)to\(K\)do
2: Compute attention coefficients:
3:for edge \((u,v)\in E\)do
4:\(\mathbf{z}_{uv}\leftarrow\text{CONCAT}(\mathbf{h}_{u}^{(k-1)},\mathbf{h}_{v}^{ (k-1)})\)
5:\(\alpha_{uv}\leftarrow\text{LeakyReLU}(\mathbf{W}_{\text{attn}}\mathbf{z}_{uv})\)
6:endfor
7: Normalize attention:
8:\(\alpha_{uv}\leftarrow\text{Softmax}(\{\alpha_{uv}|u\in\mathcal{N}(v)\})\)
9: Aggregate messages:
10:for node \(v\in V\)do
11:\(\mathbf{h}_{v}^{(k)}\leftarrow\sum\alpha_{uv}\cdot(\mathbf{W}_{\text{msg}} \text{CONCAT}(\mathbf{h}_{u}^{(k-1)},\mathbf{e}_{uv}))\)
12:endfor
13:\(\mathbf{z}_{v}=\mathbf{h}_{v}^{K}\)
14: Update Edge features:
15:for node \(u,v\in V\)do
16:\(\mathbf{z}_{uv}\leftarrow\text{CONCAT}(\mathbf{z}_{u}^{(k)},\mathbf{z}_{v}^{ (k)})\)
17:endfor
18:endfor
19:return \(\mathbf{Z}_{uv}^{K}\), \(\mathbf{Z}_{v}\)
```  
**Algorithm 1** Attention-Based Graph Edge Embedding. After Softmax normalization for neighbor weights, we fuse node and edge features during message propagation, rather than traditional GNNs that ignore edge semantics. \[\mathbf{h}_{v}^{(k)}\leftarrow\sum\alpha_{uv}\cdot(\mathbf{W}_{\text{msg}} \text{CONCAT}(\mathbf{h}_{u}^{(k-1)},\mathbf{e}_{uv}))\]  
This step embeds edge-specific information (e.g., flow protocols, interaction frequency) into the node representation, enhancing the model's ability to distinguish critical attack paths from noisy edges.