## 1 Introduction  
Intrusion detection systems (IDSs) [1; 2; 3] have been introduced to monitor the network status, assess the security status, and take appropriate precautionary measure before the attack with serious consequences. IDSs are classified into signature-based detection [4] and anomaly-based detection [5]. Signature-based intrusion detection has the ability to detect known attack behavior. Anomaly-based detection has the ability to detect known attack behavior and unknown attack behavior by analyzing the features of network packets. Anomaly-based detection requires finding features that accurately characterize network packets. However, the network packet preprocessing methods suffer from low performance to extract features [6]. One of the main reasons to lead the above situation is that the features extracted by the existing unsupervised algorithms [7; 8; 9] are not accurate to preprocess network packets. The network packets in the existing unsupervised algorithms [7; 8; 9] are considered to be independent. These algorithms ignore the similarity relationship between network packets. According to homophily hypothesis [10], it can be seen that network packets with strong similarity belong to the same class and are closer in the similarity relational graph. In addition, network packets with strong similarity have similar local proximity embedding [11]. Skip-gram [12] can be used to embed the local proximity features of the similarity relationships between network packets. Therefore, it can be concluded that the analysis of the similarity relationship between network packets has the ability to be more flexible and accurately determine whether the network packet has an intrusion. Moreover, effective preprocessing is the basis for improving the performance of the entire IDS because the network packet features obtained by preprocessing directly affect the final performance of the IDS. Graph representation approaches have a good potential for achieving effective similarity relationship representation of network packet. Therefore, this paper proposes a packet2 vec learning algorithm preprocessing network packet, which is an unsupervised preprocessing algorithm based on graph representation learning. The algorithm uses packet2 vec for preprocessing to obtain local proximity features that describe the similarity relationship between network packets. The local proximity features are combined with the original features of the network packet to describe the network packet. The performance of IDS is improved by the increase in effective information in preprocessing. The motivation to introduce graph representation for network packets preprocessing is as follows. The graph representation learning algorithm has achieved good results in the application of approximate semantic classification of words [12]. An interesting analogy is that we treat a network packet as a word. Then, the problem of distinguishing the class of network packet according to the similarity relationship between network packets can be regarded as the approximate semantic classification problem of words. In the approximate semantic classification of words, similar words tend to appear in similar word neighbors [10]. Therefore, network packets belonging to the same class also have similar local neighbors, where the class consists of DDOS, HttpDos, normal, Brute Force SSH, Infiltrating [13; 14; 15]. That is, whether there are similar local neighbors has the ability to characterize the similarity between network packets. Therefore, we believe that the features obtained by preprocessing network packets based on graph representation learning algorithm have the ability to achieve better performance of IDS. The main contributions of this paper are as follows. (1) In order to improve the performance of the existing unsupervised algorithms of intrusion detection, this paper proposes a packet2 vec learning algorithm to extract the local proximity features of network packets.