## 5 Discussion
If the local neighbor sample list of the source network packet is obtained in other ways (for example, all first-order proximity nodes and second-order proximity nodes of the source network packet are directly used to form a local proximity list), the method does not have the ability to obtain structure and distance information between the network packets. Therefore, it is very meaningful to capture the local proximity nodes of the source network packets in a random walk. In addition, this article focuses on the relationship between network packets and extracts the features of network packets. In the future work, network flows and network packets will be analyzed hierarchically [46; 47; 48; 49]. We analyzed the sensitivity of the proposed algorithm. From Table 14, we can draw the following conclusions. In the best case, the accuracy, the detection rate, the precision, and the \(F_{1}\) of packet2 vec-AE are up to 94.7%, 90.9%, 94.3%, and 92.6%, respectively. In the worst case, the accuracy, the detection rate, the precision, and the \(F_{1}\) of packet2 vec-AE reached 87.4%, 81.1%, 87.3%, and 84.1%, respectively. In the worst case, the proposed algorithm achieves the good performances regarding the accuracy, the precision, and the \(F_{1}\) exceeding those of the other state-of-the-art algorithms. Therefore, the proposed algorithm is still superior to the latest algorithms available even if the selected parameters are not suitable. From the experimental results of Tables 8 and 9, it can be concluded that fluctuation range of the accuracy, the detection rate, the precision, and the \(F_{1}\) is not large regardless of how these parameters are changed. In other words, the experimental results are not sensitive to the parameters. Therefore, we have reason to believe that the proposed algorithm has the potential to be extended to other data sets. In future work, we will apply this algorithm to other data sets. In order to highlight the novelty and contribution of this paper, we compare the similarities and differences between our algorithm and existing algorithms in Tables 15 and 16. Table 15 compares the similarities and differences between the latest three unsupervised IDS algorithms and our proposed algorithms. Most existing studies on unsupervised IDS preprocessing ignore the relationship among packets. As a result, the performance of existing unsupervised IDS is not high. According to homophily hypothesis, the local proximity structure in the similarity relational graph has similar embedding after preprocessing. Our proposed algorithm pre-processing combines the local proximity feature of the network packet with the original features of the network packet as input to the Deep Auto-Encoder. Our proposed algorithm is equivalent to the use of local proximity features of network packets to enhance the original features of network packets. From Table 15, we can conclude that the performance of the existing PCA-IDS 2017 [8] and RBM-IDS 2017 [7] depends on the features of manual experience extraction. Our proposed algorithm uses graph representation learning for automatic preprocessing. Therefore, our proposed algorithm is suitable for raw network traffic data. Table 16 compares the latest graph representation of the similarities and differences between the learning algorithm and our proposed algorithm. Deepwalk [20] and Node2 vec [10] are easy to sample into the higher-order proximity range, which make it impossible to accurately describe the low proximity features of the current node; LINE [21] does not have the ability to simultaneously sample first-order proximity and second-order proximity, so the algorithm has limitations; Our proposed algorithm has the ability to extract first-order proximity, second-order proximity, and low-order proximity. This is the first time in the intrusion detection to extract features using the graph representation leaning algorithm. We have increased the analysis of the effect of random walk length on the running time cost of the algorithm.