## 6 Results and Discussion
### Comparison of Model Performance  
We evaluated the effectiveness of the proposed model by comparing the weighted F1 scores obtained with previous models. Firstly, the proposed model was compared to GNN-based models currently considered most effective, such as E-GraphSAGE [40] and conventional GCN models. We used the E-graphSAGE and GCN models introduced in those papers to conduct the experiments classifying malicious flows in two datasets: CIC-IDS2017 and UNSW-NB15. In the case of the E-GraphSAGE model, edge features are extracted from flow data before their application in edge classification. Meanwhile, the GCN model utilizes these data as node features. The results obtained for each model are compared to the proposed model in Figure 15. We can see that the proposed model achieves a superior performance compared to the rest. This comparison result proves that the proposed model has reasonably inherited the strengths of SAGEConv layers and the GCN model. Table 6 presents comparative data on the performance and execution time of the proposed model with the E-GraphSAGE and conventional GCN models. These experiments  
Figure 14: ROC on the test set of UNSW-NB15. Figure 15: Comparison of the testing accuracy with previous models. were performed with 424,155 flows taken from the CIC-IDS2017 dataset, in which the number of flows for the train set is 339,324 flows and the test set is 84,831 flows. Comparative data show that the proposed model always performs better than other models in precision, recall, and F1-score metrics. This means that the proposed model achieves a higher and more accurate detection rate of attack flows. However, the training and prediction times of the proposed model are not excessive compared to previous models. This can be explained based on how graph data are created from network flows as well as the architecture of each model. For the E-GraphSAGE model, graph data are created based on the network topology, in which each IP address corresponds to each node, and the number of edges represents the number of flows generated between those nodes. Meanwhile, the FN-GNN model proposes a new data preprocessing method that allows one to exploit the relationships between flows when creating graph data. In this way, each node represents each flow, and the number of edges created depends on each connection between flows in the network. We realized that, with the same amount of network flow, the graph data of the proposed model have a larger number of nodes and edges and Are more complex than the graph data of E-graphSAGE. Therefore, the training and prediction time of the proposed model will also be a bit longer than that of E-GraphSAGE. On the other hand, the proposed model has a more optimal execution time than the conventional GCN model. The GCN layer included in the GCN model uses the entire adjacency matrix to synthesize information from neighboring nodes, while the SAGEConv module applied in FN-GNN helps represent nodes by synthesizing information from several neighboring nodes. Therefore, for large graph data, the GCN model must process information from a vast number of connections, significantly increasing the system resource requirements and computation time. In contrast, the neighbor sampling mechanism enables the proposed model to efficiently utilize resources and optimize the computation time when applied in large-scale network environments. To objectively assess the model's performance, we compare its weighted F1 scores with other existing models based on published results on the same datasets. The selected models are those that achieved the most outstanding results on the datasets used in this study. On the CIC-IDS2017 dataset, we compared with models using machine learning techniques such as OC-SVM/RF [41], SVM, and ANN [42], as well as deep learning models like CNN-GRU [43], CNN-BiLSTM [44], and a two-phase intrusion detection system with naive Bayes [45].