Adversarial Hierarchical-Aware Edge Attention Learning Method for Network Intrusion Detection

The rapid development of information technology has made cyberspace security an increasingly critical issue. Network intrusion detection methods are practical approaches to protecting network systems from cyber attacks. However, cyberspace security threats have topological dependencies and fine-grained attack semantics. Existing graph-based approaches either underestimate edge-level features or fail to balance detection accuracy with adversarial robustness. To handle these problems, we propose a novel graph neural network–based method for network intrusion detection called the adversarial hierarchical-aware edge attention learning method (AH-EAT). It leverages the natural graph structure of computer networks to achieve robust, multi-grained intrusion detection. Specifically, AH-EAT includes three main modules: an edge-based graph attention embedding module, a hierarchical multi-grained detection module, and an adversarial training module. In the first module, we apply graph attention networks to aggregate node and edge features according to their importance. This effectively captures the network’s key topological information. In the second module, we first perform coarse-grained detection to distinguish malicious flows from benign ones, and then perform fine-grained classification to identify specific attack types. In the third module, we use projected gradient descent to generate adversarial perturbations on network flow features during training, enhancing the model’s robustness to evasion attacks. Experimental results on four benchmark intrusion detection datasets show that AH-EAT achieves 90.73% average coarse-grained accuracy and 1.45% ASR on CIC-IDS2018 under adversarial attacks, outperforming state-of-the-art methods in both detection accuracy and robustness.