A Hybrid Approach to Network Intrusion Detection Based On Graph Neural Networks and Transformer Architectures

Authors: hongrun  zhang
Venue: IEEE_org_ICIST_2024_Conference
Published: 2024-08-14 06:40:48

Abstract: In this paper, we propose a model of a Network Intrusion Detection System (NIDS) named E-T-GraphSAGE (ETG), which fuses Graph Neural Network (GNN) and Transformer techniques. With the widespread adoption of the Internet of Things (IoT) and cloud computing, network structures have become complex and vulnerable. The efficacy of traditional intrusion detection systems is limited in the context of novel and unconventional cyber-attacks. This paper proposes a novel approach to address this challenge. GNN is used to capture the complex relationships between network nodes and edges, analyze network traffic graphs, and identify anomalous behaviors. By introducing the Transformer, the model enhances its ability to handle long-range dependencies in network streaming data and to understand network dynamics at a macro level. The GraphSAGE-Transformer (ETG) model is proposed to optimize the edge features through the self-attention mechanism to exploit the potential of network streaming data and improve the accuracy of intrusion detection. The experimental results show that the model outperforms the existing techniques in key performance metrics Tests on several standard datasets (BoT-IoT, NF-BoT-IoT, NF-ToN-IoT) validate the broad applicability and robustness of the ETG model, especially in complex network environments.

Main paper: 
 introduction: 
 With the widespread adoption of the Internet of Things (IoT) and cloud computing, the structure of network systems is becoming more complex, and the types and numbers of devices are increasing dramatically. This environment provides more vulnerabilities and points of entry for cyber attackers, making traditional cyber defense systems face serious challenges [1] . Modern network attacks are varied, including distributed denialof-service (DDoS) attacks, malware spread, and data breaches but also more subtle and adaptable, frequently targeting multiple layers of the network and various nodes. In addition, with the rapid development of attack techniques, new and unknown zeroday vulnerability attacks frequently appear, and these attacks are able to bypass the signature-based intrusion detection system easily [2] . Therefore, there is a need to develop new detection techniques that not only recognize known attack patterns but also can predict and adapt to unknown threats.To overcome these limitations, recent research has increasingly focused on leveraging machine learning and deep learning techniques. Among these, Transformer architectures have gained attention for their self-attention mechanism, which effectively captures long-range dependencies in sequential data. Originally developed for natural language processing, Transformers have been successfully adapted for cybersecurity applications, offering the ability to analyze complex interdependencies within network traffic.Graph neural networks (GNNs), known for their ability to handle graph-structured data, offer significant potential in cybersecurity applications. By capturing the complex relationships between nodes (e.g., IP addresses or devices) and edges (i.e., data transmissions or sessions) in a network, GNNs are able to efficiently map the overall pattern of network behavior. This capability makes GNN particularly suitable for identifying and analyzing complex network intrusions that are difficult to detect through conventional detection means [3] . GNNs can analyze network traffic graphs by representing hosts or servers as nodes and their communications as edges. By learning the normal and abnormal characteristics of these communication patterns, the GNN is able to identify anomalous behavior in the network, such as unauthorized data access or abnormal data traffic. In addition, a key advantage of GNNs is their ability to integrate data from multiple sources and extract deep network characteristics, which is particularly important for detecting advanced persistent threats (APTs) and multi-stage attacks.GNN not only enhances the detection of known threats, but more importantly, it provides a mechanism to understand and predict new or variant attack behaviors that are difficult to identify with traditional methods. Therefore, the introduction of GNN into network security systems, especially network intrusion detection systems, will greatly enhance the system's ability to defend against complex network threats [4] . This research aims to develop an enhanced Network Intrusion Detection System (NIDS) by integrating Graph Neural Networks (GNNs) with Transformer architectures. The goal is to improve the efficiency and accuracy of detecting complex and previously unknown attack patterns by leveraging the Transformer's ability to capture long-range dependencies in network traffic. This integration seeks to enhance the model's capability to analyze network flows on both local and global scales, improving overall performance in detecting sophisticated cyber threats.The proposed study will use a hybrid approach, combining GNNs and Transformers to analyze network traffic. GNNs will be employed to construct graph representations of network entities and interactions, while the Transformer's self-attention mechanism will capture long-range dependencies and global patterns [5] . This integrated model aims to enhance understanding of network dynamics and improve detection and prediction of both known and emerging threats. The model's effectiveness will be evaluated through experiments on benchmark datasets, comparing its performance with existing intrusion detection systems. As shown in Fig. 1 , we utilize both GNN and Transformer to encode the raw stream data successively to obtain the desired graph data structure, which is input to the model for training.(1) The core contribution of this research is the development of a NIDS model that combines GNN and Transformer. The edge features optimized by the self-attention mechanism fully exploit the potential of network streaming data and significantly improve the detection accuracy of network intrusion.(2) Tests on multiple standard datasets show that our model outperforms existing techniques in key performance metrics such as accuracy, recall, and F1 score.The rest of the paper's organizational sequel will detail the design and experimental evaluation of the E-T-GraphSAGE (ETG) model. Part II will explore the development of NIDS, as well as research related to GNNs and Transformers. Part III details the model architecture and key technologies. The fourth section shows the experimental results on a variety of cyberattack datasets and compares them with other methods. The concluding section will summarize the research results and discuss future research directions.In recent years, various approaches have been proposed to enhance the performance of Intrusion Detection Systems (IDS) Alowaidi et al. [6] proposed a hybrid Intrusion Detection System (IDS) combining Machine Learning (ML) and Deep Learning (DL) techniques, which enhances IDS performance and prediction accuracy while lowering computational costs. However, the model's generalization relies on the diversity and representativeness of the training data. If the training data is biased, it negatively impacts the model's real-world performance. Gupta et al. [7] proposed an anomaly-based NIDS, this approach considers multiple performance metrics, along with training time and resource usage, but remains limited by dataset dependency and average generalization capabilities. Kumar et al. [8] proposed a bi-directional long short-term memory (BiLSTM) based anomaly detection system for Internet of Things (IoT) networks. The BiLSTM model effectively improves the accuracy by preprocessing and feature selection through normalization and gain ratio.Suá rez-Varela et al. [9] introduced the use of GNNs in the modeling control, and management of communication networks, demonstrated their advantages in terms of generalization capabilities and data-driven solutions, and discussed their potential in network modeling control and management. Hnamte et al. [10] proposed an approach using Deep Convolutional Neural Networks (DCNN) and validated its performance with the InSDN dataset. While DCNN achieves high accuracy, it demands significant data and computational resources for training.Kisanga et al. [11] proposed a new Activity and Event Network (AEN) graph framework that focuses on capturing long-term stealthy threats that are difficult to detect by traditional security tools, and is very promising in detecting long-term threats in cybersecurity. L et al. [12] proposed an endto-end anomalous edge detection method based on unified graph embedding, which enhances the model's ability to learn taskrelevant patterns by combining embedding learning and anomaly detection into the same objective function, and accurately estimates the probability distributions of edges through the local structure of the graph to identify anomalous edges. Superior accuracy and scalability are demonstrated on multiple publicly available datasets. Sun et al. [13] proposed a framework combining Graph Neural Network (GNN) and Transformer for self-supervised heterogeneous graph representation learning. The Metapathaware Hop2Token method is designed to efficiently convert neighbors with different hop counts in heterogeneous graphs into Token sequences, reducing the computational complexity in Transformer processing. GTC enhances information fusion, improves learning efficiency, and reduces the demand for computational resources by contrasting learning tasks between graph pattern views and hop count views.Nguyen et al. [14] proposed a Transformer-based GNN model for learning graph representation. With an unsupervised conduction learning approach, UGformer is able to solve the problem of limited category labels, but for large-scale datasets to construct graphs, UGformer may still need to be optimized to deal with extremely large graph structures, despite the sampling mechanism that UGformer is designed for.Unlike previous studies, our method focuses on extracting data edge features from network streams and develops E-GraphSAGE models that incorporate transformer modules. Combining local and global features to achieve more accurate feature representations, making full use of the structural and topological information and inherent in network streaming data to achieve better feature representations and network intrusion detection performance. The T-E-GraphSAGE method introduced in this paper addresses the shortcomings of traditional graph embedding techniques by capturing topological details and edge features in network flow data, leading to more precise detection. while its ability to effectively classify samples with unseen node features. Three NIDS standard datasets are used to evaluate our model, which verifies the broad applicability accuracy, and robustness of our model in different types of network scenarios, which is effective in comparison with traditional ML methods, especially in complex network environments. Through these improvements, the performance of our system in network intrusion detection has been significantly improved, and it is able to effectively respond to various network attacks in complex network environments.Graph Neural Networks (GNN) are becoming increasingly popular in the field of machine learning. Its power stems from the effective utilization of graph-structured data. These data are widely available in application areas such as social media networks, biological research, and telecommunication systems [15] . The primary reason for using GNN in NIDS is their capability to leverage the structural data present in network streams, which can be represented graphically. Although some conventional machine learning approaches also handle graph data, they usually involve intricate processes and depend heavily on manually crafted features, leading to more cumbersome and less efficient applications.GraphSAGE [16] is an efficient graph neural network technique that generates embedded representations of nodes by sampling and aggregating the features of their neighbors. It is particularly suitable for processing large-scale graph data. The main steps include sampling neighboring nodes, aggregating features, and updating node features, which effectively solve the computation and storage bottlenecks of traditional graph neural networks. As a result, GraphSAGE has been widely used in many fields.GraphSAGE : learning node representation through local aggregation, and its core steps include three aspects: neighbor node sampling, feature aggregation, and node feature update, as shown in Fig. 2 .In neighbor node sampling, for each node, a fixed number of neighbor nodes are randomly sampled to reduce the computation and storage requirements. Suppose a node in the graph is 𝑣, and its set of neighbor nodes is 𝑁(𝑣) , and the set of neighbor nodes obtained from sampling is 𝑁 ̃(𝑣) . This process can be represented as:( ) ( ( ), ) N v Sample N v K = (1)where 𝐾denotes the number of neighbor nodes sampled. This phase seeks to manage computational complexity by limiting the number of adjacent nodes for each vertex in extensive graphs. EQUATIONwhere ℎ 𝑢 (𝑘-1) denotes the feature representation of the neighboring node at the 𝑘 -1 th layer of 𝑢, and ℎ 𝑁 ̃(𝑣) (𝑘) denotes the representation of the node 𝑣 after aggregating the features of its neighboring nodes at the 𝑘 layer.2) Maximum pooling: Maximum pooling is used to take the maximum value in the features of neighboring nodes. The formula for this is:( ) ( 1) () ({ , ( )}) kk u Nv h max h u N v - =   (3)3) LSTM aggregation: LSTM aggregation uses LSTM network for neighbor node features with the formula:EQUATIONFor node feature update, the algorithm combines the node's own features with the aggregated neighbor features and updates the node feature representation through a neural network. A common way of combining is a concatenation operation (concatenation) followed by a transformation through a fully connected layer. Its formula is:EQUATION)EQUATIONwhere 𝜎 denotes the activation function (e.g., ReLU), 𝑊 (𝑘) denotes the weight matrix of the 𝑘-th layer, and ℎ 𝑣 (𝑘) denotes the feature representation of node 𝑣 in the 𝑘-th layer.In the specific process, the features are first initialized and each node's feature can be its attribute vector 𝑥 𝑣 . Then multilayer sampling and aggregation is performed, for the 𝑘-th layer, each node randomly samples a fixed number of 𝐾 neighbors from its neighborhood to form the sampling set 𝑁 ̃(𝑣) and aggregates the features of the neighboring nodes using the selected aggregation function (e.g., mean, maximum pooling, or LSTM) to obtain ℎ 𝑁 ̃(𝑣) (𝑘) . Then the node 𝑣 own features are connected to the aggregated neighboring features in a join operation and nonlinearly transformed through the fully connected layer to obtain a new node feature representation ℎ 𝑣 (𝑘) . Finally, after multi-layer (usually 2 to 3 layers) sampling and aggregation operations, the embedding representation of each node is finally generated ℎ 𝑣 . Through the above steps, the GraphSAGE algorithm is able to efficiently deal with largescale graph data, and generate high-quality node embedding representations through sampling and aggregation operations.The traditional GraphSAGE method mainly focuses on the analysis and utilization of node features for node classification, but is deficient in dealing with edge features. The primary objective of NIDS aims to detect and identify malicious traffic. In our study, we focus on the application of edge features and improve the GraphSAGE model by using the edge embedding method and introducing the Transformer layer method.1) E-GraphSAGE: In order to handle graph structure data efficiently, we designed and implemented the GraphSAGE layer (SAGELayer). This layer updates the representation of each node by aggregating the features of the node's neighbors to capture the relationships between nodes in the graph. GraphSAGE accomplishes the updating of node representations through message passing and apply updates, and employs the ReLU activation function to improve the model's nonlinear representation [17] . The main differences from the original GraphSAGE algorithm are the algorithmic inputs, the message passing aggregation functions and the outputs. In the SAGE layer, edge embedding is incorporated into the messaging process to provide richer information. Unlike the traditional GraphSAGE module, the aggregated embedding of sampled neighboring edges is generated at the kth layer for edge features. using a mean aggregation function as shown in the following equation. ( , ),EQUATIONIn our study, we constructed a two-layer E-GraphSAGE model with each layer consisting of an E-SAGELayer.Neighboring node features are aggregated to generate the embedded representation of the node and a mean value aggregation method is used, where the features of the node are the mean value of the features of its neighboring nodes. The first layer E-SAGELayer in this model aggregates the input features to generate the first layer of node embedding; The second layer takes the first layer of node embeddings as input and again performs aggregation to generate the final node embeddings. Through this multi-layer aggregation, we are able to capture more complex node characteristics and neighbor relationships. A Dropout operation is used to avoid overfitting. The advantage of stacking multiple layers of GraphSAGE is the ability to capture more complex node relationships and form richer node representations to improve the performance of the model.The traditional GraphSAGE method mainly focuses on the analysis and utilization of node features for node classification, but is deficient in dealing with edge features. The primary aim of NIDS is to detect and identify malicious traffic, aligning with the edge classification problem in network flow classification. Our study emphasizes the use of edge features and enhances the GraphSAGE model by incorporating the edge embedding method and introducing the Transformer layer technique.The Transformer Encoder Layer (TEL) is the basic component of the Transformer model, which mainly consists of the MultiheadAttention mechanism, Feed-forward Neural Network (Linear Layer), and Normalization Layer (LayerNorm), and Dropout is applied between the layers to prevent overfitting. In the Transformer Encoder Layer, the inputs are node features (generated by the SAGE layer) and this layer does not explicitly process edge features. Its main function is to capture the dependencies between node features and global information through a multi-head attention mechanism along with a feedforward neural network. where 𝐴𝑡𝑡𝑒𝑚𝑡𝑖𝑜𝑛(𝑄, 𝐾, 𝑉) is the single-head self-attention computation, Q denotes the computational query matrix, K denotes the key matrix, V denotes the value matrix, d denotes the input vector dimension, and 𝑀𝑢𝑙𝑡𝑖𝐻𝑒𝑎𝑑(𝑄, 𝐾, 𝑉) denotes the multi-head self-attention splicing the results of the h heads together and obtaining the final output by a linear transformation, where ℎ𝑒𝑎𝑑 𝑖 = 𝐴𝑡𝑡𝑒𝑛𝑡𝑖𝑜𝑛(𝑄 𝑖 , 𝐾 𝑖 , 𝑉 𝑖 ) , and 𝑊 𝑂 ∈ ℝ ℎ𝑑 𝑘 ×𝑑 𝑚𝑜𝑑𝑒𝑙 is the output weight matrix and 𝑑 𝑚𝑜𝑑𝑒𝑙 is the input feature dimension.Specifically, the MultiheadAttention mechanism captures the global dependencies of the input data by processing the input data in parallel through multiple Attention Heads. Each Attention Head performs self-attention computation independently, which is able to focus on different features in the input data and enhance the sensitivity of the model to multiple features. The multi-head attention mechanism's output is linked to the feed-forward neural network via a linear transformation. b) Feed-forward neural network: Feed-forward neural networks (FFN) are fully connected neural networks applied independently at each position in each Transformer coding layer. The specific formula is as follows:EQUATIONwhere 𝑊 1 ∈ ℝ 𝑑 𝑚𝑜𝑑𝑒𝑙 ×𝑑𝑓𝑓 , 𝑊 2 ∈ ℝ 𝑑 𝑓𝑓 ×𝑑 𝑚𝑜𝑑𝑒𝑙 , 𝑏 1 ∈ ℝ 𝑑 𝑓𝑓 , 𝑏 2 ∈ ℝ 𝑑 𝑚𝑜𝑑𝑒𝑙 is the parameter of the science department and 𝑑 𝑓𝑓 is the hidden layer dimension of the FNN.The feedforward neural network used in this paper includes two fully connected layers with a ReLU activation function and Dropout applied in between. The first fully connected layer maps the input dimension from the embedded dimension (embed_dim) to a higher hidden dimension (ff_hidden_dim), the ReLU activation function introduces a nonlinear transformation, and the Dropout operation is used to prevent overfitting. The second fully connected layer maps the hidden dimension back to the embedded dimension, thus keeping the dimensionality of the inputs and outputs the same. where 𝜇 and 𝜎 are the mean and standard deviation of the inputs respectively, 𝛾 and 𝛽 are the learnable scaling and offset parameters and 𝜀 is a small constant.Each coding layer undergoes Layer Normalization and Residual Connection between and after the multi-head self-attention mechanism and the feed-forward neural network. Layer Normalization helps to stabilize and speed up the training process, while Residual Connection helps to solve the problem of vanishing gradients in deep networks. d) Dropout: Dropout randomly discards a certain percentage of neurons during training to prevent overfitting. By stacking multiple such coding layers, the Transformer model is able to effectively capture the global dependencies of the input data and enhance the model's sensitivity to different features. The multi-head self-attention mechanism in each layer enables the model to focus on different features in the input data, and the feed-forward neural network further processes these features. Through the layer-by-layer processing of the multilayer structure, the model is able to capture more complex and deeper feature relationships in the input data, which improves its performance in various tasks.Fig. 3 shows how the network stream data is constructed as graph data and the propagation process from the source node to the destination node. Fig. 4 shows an overview of our E-Transformer-GraphSAGE NIDS. Initially, a graph is created using the network flow data. Next, the generated network graph is fed into the E-Transformer-GraphSAGE model for supervised training. Edge embeddings are designed to classify network streams into benign or malicious categories. The following subsections explain these three steps in detail. 1) Graph data structure: Net-Flow is a commonly used format for logging network communications in production environments and is the predominant format in Network Intrusion Detection System (NIDS) environments. A flow record typically includes fields that identify the communication's source and destination, along with additional information like packet and byte counts, and flow duration. Graph structures naturally model this type of data. In this study, we use the source IP address, source port, destination IP address, and destination port. The first two fields form a binary group identifying the source node, and the last two form the destination node. The remaining data are used as features for that edge, making the graph nodes featureless. We assign a vector of all 1's to all nodes in the algorithm.2) E-Transformer-GraphSAGE: Our proposed model combines the sensitivity of GNN to local structures and the ability of Transformer to capture global dependencies by first processing the graph data through E-GraphSAGE to obtain node representations. Then, Transformer is utilized to further capture global dependencies. During the training process, we utilize a weighted cross-entropy loss function (CrossEntropyLoss) to address category imbalance. We use Adam optimizer (Adam optimizer) for parameter updating. The algorithm's output is compared with the labels from the NIDS dataset and the model's trainable parameters are adjusted in the backpropagation phase. After tuning the model parameters during training, the performance of the model can be evaluated by classifying unseen test samples. The process involves converting the test stream records into graph data structures. Edge embeddings are then generated using a trained E-Transformer-GraphSAGE layer. These edge embeddings are subsequently transformed into class probabilities the Softmax layer. The predicted class probabilities are compared with the actual class labels to evaluate the classification performance metrics.In this section, We performed binary classification and multiclassification task comparisons to validate the effectiveness of our algorithm.We modeled using Python, Pytorch, and DGL, and the server environment was performed on an Intel(R) Xeon(R) Gold 6242 CPU @ 2.80GHz total of 32 cores, a single A100 graphics card, and 192G RAM.To evaluate our proposed GNN-based NIDS, we use three publicly available datasets that include various labeled attack flows and benign network flows. The first dataset is BoT-IoT, which is widely used for evaluating ML based network intrusion detection systems in the Internet of Things, with a proprietary format and feature set. The second and third datasets are NF-ToN-IoT and NF-BoT-IoT presented in Netflow format.1) BoT-IoT datasets: The BoT-IoT dataset [18] was generated by the Cyber Range Lab at the Australian Center for Cyber Security (ACCS) to evaluate the performance of cyber security tools. It simulates real network environments containing normal traffic and multiple types of malicious traffic such as DDoS, DoS, reconnaissance, and data theft for Intrusion Detection System (IDS) training and testing. Avoid combining SI units, like current in amperes, with CGS units, such as the magnetic field measured in oersteds, as this can cause dimensional imbalance and confusion. If using mixed units, clearly specify the units for each quantity in the equation.2) NF-BoT-IoT datasets: The NF-BoT-IoT dataset [19] is a NetFlow characterization dataset extracted from the BoT-IoT dataset to provide a more concise representation of network traffic by summarizing IP traffic flows. The dataset includes information such as source and destination IP addresses, ports, packet counts, byte counts, and timestamps, which helps in large-scale data analysis and real-time intrusion detection.3) NF-ToN-IoT datasets: The NF-ToN-IoT dataset is a NetFlow characterization dataset generated based on the ToN-IoT dataset and contains telemetry and operational network data from Internet of Things (IoT) devices. The dataset provides detailed traffic records that help detect network intrusions and understand traffic patterns in IoT environments and is suitable for IoT security research.To assess the effectiveness of the proposed neural network model, we employed the standard metrics outlined in Table I . Here, TP stands for true positives, TN for true negatives, FP for false positives, and FN for false negatives. The datasets employed in our experiments contain dual-layer labels for each data instance. The first layer indicates whether the network flow is benign or non-benign, while the second layer specifies the attack type. For the binary classification task, we use the first layer of labels, and for the multi-class classification task, we use the second layer of labels [20, 21] . Table Ⅱ summarizes our model's performance metricsaccuracy, precision, F1-Score, and False Alarm Rate (FAR)-across three datasets: BoT-IoT, NF-BoT-IoT, and NF-ToN-IoT. The findings demonstrate that our method performs exceptionally well in binary classification, a key factor for successful network intrusion detection.In cybersecurity, datasets frequently exhibit an imbalance, with fewer attack samples compared to normal traffic. The F1-Score is particularly important in such scenarios as it balances precision and recall, providing a more accurate assessment of the model's ability to differentiate between benign and malicious traffic than accuracy alone.Given the importance of precise intrusion detection, particularly in practical applications where the cost of missed detections is high, we prioritize the F1-Score as a more reliable indicator of our model's performance. In the following sections, we will compare our F1-Score with those from other studies to demonstrate how effectively our model handles the challenges of imbalanced datasets, ensuring dependable intrusion detection. Table Ⅲ shows the F1 of our method compared with other algorithms [21, 22] . The results show that our method achieves F1-Scores that are either similar to or better than those of existing approaches. This indicates that our method performs effectively in both traffic classification and binary network intrusion detection.The comparable or superior F1-Scores demonstrate that our model is not only accurate in identifying malicious network traffic but also maintains a balanced performance across different datasets. This balance is crucial in practical applications, where high precision and recall are necessary to minimize false positives and ensure reliable intrusion detection.In summary, the data in Table III confirms that our method is competitive with, and in some cases superior to, other leading algorithms, highlighting its effectiveness in traffic classification and network intrusion detection tasks. IV presents the multi-classification results of our method across three standard datasets, where the classifier is tasked with distinguishing between various attack types. The multi-classification problem is more complex than binary classification, as it requires the model to accurately identify not just whether an attack is present, but also to specify the type of attack. The results in However, the experimental plots of confusion matrices shown in Figures 5 and 6 for the NF-BoT-IoT and NF-ToN-IoT datasets reveal some nuances in the model's performance. While the recognition rate is extremely high for several attack types, the model struggles with accurately classifying DDoS attacks. This issue likely stems from the fact that during model training, DDoS and DoS attacks shared similar features, leading to a significant overlap in their learned representations. As a result, the model occasionally misclassifies DDoS attacks as DoS attacks, which suggests that the feature extraction process may need refinement to better distinguish between these two attack types.The observed difficulty in separating DDoS from DoS attacks highlights a potential area for improvement. One possible solution could involve enhancing the feature engineering process to capture more distinctive characteristics of these attack types. Additionally, adjusting the training process to emphasize the differences between DDoS and DoS attacks, perhaps through the use of more advanced techniques like adversarial training or ensemble learning, could further improve classification accuracy.In summary, while our model excels in the multiclassification of several attack types, especially within the BoT-IoT dataset, there remains room for improvement in the classification of closely related attacks such as DDoS and DoS. Addressing these challenges will be crucial for further enhancing the model's overall reliability and effectiveness in real-world network security applications. As with binary classification, we compared the performance of our model's Network Intrusion Detection System (NIDS) with other classifiers, as shown in studies [23, 24] . Table VI presents the results of this comparison, focusing on the multi-classification task.The findings reveal that our algorithm consistently achieves higher average F1-Score values compared to all existing methods. This is particularly important in multi-classification, where the ability to accurately distinguish between multiple types of network attacks is crucial. The superior F1-Score suggests that our model not only identifies attacks effectively but also excels in correctly classifying the different types of attacks, a challenge where other classifiers often fall short.These results underscore the effectiveness of our approach in handling the complexities of multi-class network intrusion detection, proving that our model outperforms current leading methods in this critical area. Overall, our method demonstrates superior performance compared to other Network Intrusion Detection System (NIDS) approaches across both binary and multi-classification tasks, as evidenced by the results from the three datasets utilized in our study. Our model not only achieves higher accuracy and F1-Scores but also shows remarkable robustness and generalizability. This indicates that it is well-equipped to handle various types of network traffic and detect both known and emerging threats effectively. The model's ability to consistently outperform other methods highlights its advanced capabilities in accurately identifying and classifying different types of network attacks, whether it's simply distinguishing between benign and malicious traffic or correctly categorizing specific attack types. This robust performance across diverse datasets suggests that our method is adaptable to different network environments and can maintain its effectiveness even when faced with the complexities and variabilities of real-world data.In this paper, we have introduced a novel GNN-based network intrusion detection method called E-T-GraphSAGE, which has enhanced attack flow detection by capturing edge features and topology patterns within network flow graphs. Our focus has been on applying E-T-GraphSAGE to detect malicious network flows in the context of network intrusion detection. Experimental evaluations have shown that our model performs very well on the three NIDS benchmark datasets and generally outperforms currently available network intrusion detection methods. In the future, we plan to build unsupervised graph neural network intrusion detection models, as well as lighten the E-T-GraphSAGE model and apply it to edge network servers, especially small and medium-sized network devices, for better timely network intrusion detection at the edge. 
 
 Appendix:  



Reviews: review: title: title: This study extracted over ten health indicators and designed a hybrid model: DAE-CNN-BiLSTM-Attention , which demonstrated excellent performance. The obtained result is valuable and can be accepted after responding the following comments.
main_review: main_review: This study extracted over ten health indicators and designed a hybrid model: DAE-CNN-BiLSTM-Attention , which demonstrated excellent performance. The obtained result is valuable and can be accepted after responding the following comments. 
1. The introduction should not merely outline the current work; it needs to be expanded and restructured.
2. In the simulation section, additional analysis is required to more thoroughly explain the main results of the paper; what's currently provided is insufficient.
3. There are numerous typos and grammatical errors. The authors should have the text reviewed by a native English speaker or use software tools for editing.
4. The conclusion of the article should be written using the present perfect tense.
title: title: accept
main_review: main_review: 1.There are many grammatical and typographical errors in the manuscript. Please check the full text carefully and correct them. 2.The engineering background of the proposed problem should be stated more clearly to readers. The literature review is insufficient. Some recently published papers should be included in the references list. 3.Based on the proposed idea and obtained results in this paper, the authors should be able to present some more descriptions in conclusion part, for example, further study direction.
title: title: accept
main_review: main_review: The paper extracted over ten health indicators and designed a hybrid model: DAE-CNN-BiLSTM-Attention , which demonstrated excellent performance. .The theory is correct and can be accepted after responding the following comments.
(1)In the introduction, it is not enough to state the current work. It should be expended and reconstructed.
(2)There are many typos and grammar errors. The authors should have a native English speaker or software packages to perform the editing check.
(3)The conclusion of the article suggests using the present perfect tense for description.

Comments: title: This article is very interesting and a good one
comment: Dear Reviewer,

Thank you for your feedback. I have made the necessary revisions as per your suggestions:

For comment 1, I have expanded and reconstructed the introduction section.

For comment 2, I have added more analysis to the experimental section to better explain the main results of the paper.

For comment 3, I have corrected grammatical and typographical errors.

For comment 4, I have changed the tense in the conclusion section to the present perfect tense as suggested.

Sincerely, 
Hongrun Zhang
This study extracted over ten health indicators and designed a hybrid model: DAE-CNN-BiLSTM-Attention , which demonstrated excellent performance. The obtained result is valuable and can be accepted after responding the following comments.
(1) In the introduction, it is not enough to state the current work. It should be expended and reconstructed.
(2) In the simulation section, more analysis can be added to better explain the main results of this paper, that's not enough.
(3) There are many typos and grammar errors. The authors should have a native English speaker or software packages to perform the editing check.
(4) The conclusion of the article suggests using the present perfect tense for description