## 4 Proposed Method  
In prior research, the authors typically utilized nodes or edges to represent the features extracted from network traffic flows. However, given the capacity of GNN models to leverage both nodes and edges within graph data, this paper introduces a novel method for extracting features from traffic flows, encompassing both nodes and edges. Our proposed model is presented in Figure 4.  
Within the model, flow data represent the communication exchanged between two computers or devices within the network system. These data are characterized by features such as source IP, source port, destination IP, destination port, protocol, etc. We employed the random forest regression algorithm to evaluate the impact and necessity of each feature based on the 'important weight' index. This allowed us to select a subset of relevant features from the data to be used in our proposed model. Subsequently, these selected features were used to construct the nodes and edges in the graph network representation, as illustrated in Figure 5.  
This feature selection method helps our approach focus on meaningful information in the flow data and avoid distortions. By doing so, the proposed model can more effectively exploit the characteristic patterns in the data. This allows the model to achieve higher accuracy compared to other models that use only a few features from the flow data. Next, we initialize a graph using the extracted features as nodes. For edge creation, we leverage the IP addresses presented in each flow of data. Specifically, edges were established between flows sharing the same source IP. The output of the pre-processing data is the graph data, which is used to feed the next GNN model. After the preprocessing step, we obtained graph data. These data are used as input for the node classification model to find suspicious network flows in the network. In this study, we proposed a modified version of the GCN model to perform this classification task. It is presented in Figure 6 with two SAGEConv layers and one fully connected layer as the output layer. Batch normalization layers and ReLU activation functions are also used immediately after each SAGEConv layer. The softmax function at the end of the model helps generate the most efficient predictions based on the class with the highest probability output. Figure 4: The overall view of the proposed model. Figure 5: The data pre-processing steps. Specifically, the feature vector at each node is aggregated through each SAGEConv layer. This information is then normalized and non-linearized using BatchNorm and the ReLU function immediately after each SAGEConv layer, as shown in Figure 6. In the fully connected layer, the current feature vector of the nodes is transformed into vectors with dimensions equal to the number of classes to be classified. This transformation is achieved using flattening techniques and the weight matrix multiplication of this layer. Finally, the softmax activation function is applied to the vector at each node to generate classification probabilities. The result at each node is a probability vector where the sum of the distributions is equal to 1. The model classifies nodes based on the highest probability in this vector, corresponding to the one-hot encoding matrix presented in the above figure. We proposed this model based on the idea of combining the GCN model with the SAGEConv module of the GraphSAGE model. GCN is the most popular model of GNN presented in Figure 1. In the GCN model, GraphConv layers play a key role in learning graph representations. These layers help the model effectively extract complex features and structural information through multiple convolution calculations. This architecture leads to the GCN model achieving high accuracy, but it has some limitations when working with large graph data. With large graphs, the information of each node is aggregated from all neighbors, making the data huge and causing system resource requirements and computing time to increase significantly.