## 2 Related Works  
In this section, we focus on presenting some recent studies, which are NIDS models based on graph neural networks. These are the most common approaches to using graph models to represent data collected from network traffic. Additionally, we also highlight the differences between the proposed methods and those previously existing. A common approach to applying GNN models to NIDS is to represent network flow data as graphs, with nodes identified by hosts or devices in the network, while the remaining data are placed into edges. For instance, ref. [14] represented flow data in a graph format, with network traffic flows mapped to the graph edges and the endpoints as nodes, whereas paper [15] proposed a method to represent network flows as a graph, where each node includes flow features in sort of -tuple (IP src, IP dst, port, protocol, request, response). Another graph representation approach was also presented in paper [16], where all data are represented as nodes of the graph. Specifically, the authors introduced a heterogeneous graph constructed from network flows, with three nodes created for each flow: the source host node, the flow node, and the destination host node. Paper [17] even proposed a model with graph data generated without including any flow or node features but only considering the network's topology. They ignored the edge features and initialized the node features with vectors of all ones. We recognized the commonality among these studies that the graphs are constructed based on the inherent network structure, thus resulting in graph data resembling the topology of computer networks. This approach did not allow the model to fully exploit the relationships between the generated flows in the network. This can be explained from the perspective of the GNN model's concept. According to the theory of GNN, nodes that are similar to each other are often connected through edges, while the network system's topology structure cannot generalize that relationship. This is one of the main differences between our method and previous methods. In this study, the graph data are generated by considering the relationships between flows, with each node in the graph representing the characteristics of a flow. Thus, the nodes in this graph represent their inherent similarities when connected by edges. This approach aligns with the theory of graph data representation we discussed earlier. While approaches like the above primarily classify flows based on edge features, some studies [18; 19; 20; 21] consider both node and edge features. However, leveraging edge features is negligible as they mainly focus on node features and only use edge features to improve the passing of messages between nodes. Moreover, in papers [22; 23], threats to the system were not extensively considered, as the proposed models only accounted for packets and flows transported between specific endpoints within the network. Likewise, the studies [23; 24]concentrate solely on individual flows, resulting in these models exhibiting limitations when attempting to classify network flows that were not presented in the training data. Meanwhile, our model effectively exploits the correlation between flows appearing between any two endpoints in the network system. For real-world applications, the proposed model can detect malicious flows in general, rather than solely focusing on a few types of attacks as indicated in previous studies. Additionally, the selection of features contained within the network flow for the GNN model also significantly impacts the model's effectiveness. Indeed, each network flow comprises a set of features that characterize the flow, but not all of them are considered for the identification and classification of that flow. Only specific features are selected for training the classification model based on certain methods. However, to the best of our knowledge, there have been no specific studies utilizing feature selection methods for NIDS models based on graph neural networks.