## 6 Results and Discussion
### Comparison of Model Performance
Similarly, on the UNSW-NB15 dataset, models such as AdaBoost, SVM, and DNN [46], as well as deep learning models like XGBoost-LSTM [47], AT-LSTM [48], and CNN-GRU [43], are also compared with our model. The comparison results are presented in Figures 16 and 17. Our model demonstrates a superior performance as well as high stability across multiple datasets, for both malicious and normal flow classification. Furthermore, the effectiveness of the proposed model was also evaluated through comparison with several models employing the same feature selection approach. Specifically, feature selection techniques based on the random forest regression algorithm were also applied by the authors in papers [39; 49] on the CIC-IDS2017 and UNSW-NB15 datasets, respectively. With the same selected features from the dataset, our model achieves significantly higher effectiveness. The evaluation results are shown in Table 7. This improvement can be explained by exploiting the relationship between flow data of the GNN model, through the synthesis of information from the neighbors of each node. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Metrics** & **Proposal** & **E-GraphSAGE** & **Conventional GCN** \\ \hline Training time (s/epoch) & 0.4605 & 0.3915 & 0.5735 \\ Predicting time (s) & 0.1625 & 0.133 & 0.1945 \\ Precision & 0.9926 & 0.95 & 0.92 \\ Recall & 0.9951 & 0.9454 & 0.9138 \\ F1-score & 0.9976 & 0.9477 & 0.9169 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Evaluation metrics. Figure 16: The comparison of the F1-score between the proposed model and the state-of-the-art models on the CIC-IDS2017 dataset. Figure 17: The comparison of the F1-Score between the proposed model and the state-of-the-art models on the UNSW-NB15 dataset. Experimental results on the two datasets CIC-IDS2017 and UNSW-NB15 show that the proposed model achieves superior performance and is more stable than existing models. To evaluate the effectiveness of the FN-GNN model when deployed in practice, the model's computational performance and ability to adapt to dynamic network conditions are aspects that need to be carefully considered. We have presented the computational efficiency of the model in Table 6. In network systems, NIDS continuously captures network traffic in the network. This traffic always has real-time characteristics and changes over time. New attack scenarios and techniques lead to changes in the nature of flows and the emergence of new traffic patterns in the data captured by the IDS. Furthermore, changes in network topology also lead to significant changes in network traffic. Those changes require NIDS systems to be constantly updated and able to adapt to new traffic patterns. The FN-GNN model provides a method for generating graph data based on evaluating the relationships of flows without depending on changes in network topology. Consequently, the graph data are generated flexibly according to the variations in network traffic. This approach allows the FN-GNN model to adapt to changes in network architecture within dynamic network environments. Additionally, in our experiments, we used two datasets that are among the most relevant and representative of real-world environments. Specifically, these datasets include scenarios and attack types that closely resemble actual attack patterns encountered in practical settings. By using these datasets, we ensure that our experiments reflect realistic network conditions and potential threats, thereby enhancing the applicability and effectiveness of our proposed model in real-world scenarios. Moreover, the testing data used were ones that the FN-GNN model had not encountered before. Thus, the model was evaluated on data as if these were real-world data. We believe that network environments will not undergo significant changes in the near future. Therefore, the deep learning properties and the ability to model complex patterns of the proposed model help it maintain a strong performance in practical environments.