## 1 Introduction  
In today's era, with the widespread use of the Internet, network systems are becoming increasingly vast and significantly more complex. Despite their benefits, these network systems also pose numerous risks that can cause harm to businesses and organizations. Indeed, cyberattacks are increasing both in quantity and sophistication, presenting a substantial challenge for protective systems such as intrusion detection systems (IDSs) and intrusion protection systems (IPSs). Network-based intrusion detection systems (NIDSs) [1] consistently play a pivotal and essential role in any business or organization's network system. NIDS relies on various characteristics to determine whether a network flow is normal or malicious. Different characteristics are considered depending on whether the detection mechanism is signature-based or anomaly-based. For signature-based detection [2], the system typically monitors characteristics such as known attack patterns, lists of malicious IP addresses and domains (blacklists), and the use of suspicious ports to identify unauthorized intrusions. For anomaly-based detection [3], characteristics such as traffic volume and frequency, unusual user or device behaviors, and flow attributes like duration,packet size, and inter-arrival times are considered. As a sensitive shield, NIDS detects external threats or potential risks within the network system. In the face of these challenges, NIDS systems are experiencing significant limitations in effectively detecting unknown attacks or zero-day attacks [4]. Indeed, the primary detection mechanisms of NIDS such as signature-based or anomaly-based detection are easily circumvented by modern attacks or generate false alarms. Therefore, integrating various new techniques into NIDS to enhance the detection performance is always considered an urgent requirement for modern network systems. Recently, machine learning (ML) and deep learning (DL) have been employed in various fields, such as image processing [5; 6], storage systems [7; 8; 9], wireless communication [10], and cybersecurity [11]. Many deep learning approaches, such as convolutional neural networks (CNNs), recurrent neural networks (RNNs), and traditional multi-layer perceptrons (MLPs), have also been applied to NIDS to enhance the network monitoring efficiency. However, these techniques exhibit limited effectiveness when applied to datasets comprising network flows due to a mismatch between the models and the type of data being monitored by the IDS. Conventional DL models are often trained on flat data structures, such as vectors or grid data, rendering them incapable of exploiting the complex structures of network flows. The information embedded in these complex structures is crucial for detecting advanced persistent threats (APTs) or zero-day attacks. Furthermore, the employed ML techniques focus on analyzing individual network flows, neglecting their inter-dependencies, as seen in [12; 13]. Among the various research techniques in deep learning, graph neural network (GNN) models are particularly well suited for analyzing traffic data. GNN is a subclass of deep learning techniques designed to operate on graph-structured data, consisting of 'nodes' and the connections between them, called 'edges'. This type of structure is well suited for representing relationships in various domains, such as social networks, transportation networks, and molecular structures. Similarly, network traffic, which consists of multiple flows, can naturally be represented as graph data. Moreover, the mechanism of GNN models to aggregate the information from neighboring nodes allows them to exploit the complex structures present in network data. Instead of relying on predefined features, GNNs can learn relevant features directly from the data. This reduces the dependency on manual feature engineering and enables the model to discover intricate patterns that might indicate malicious activity. The information contained in these patterns is crucial for detecting APT and zero-day attacks.