Network Threat Detection Method Integrating Graph Neural Networks and Attention Mechanism
Abstract
The increasing complexity of enterprise, Internet of Things, and Industrial Internet networks has made coordinated cyberattacks increasingly difficult to detect. This paper proposes a network threat detection method combining a Graph Neural Network with edge-enhanced multi-head attention. Bidirectional flows are represented as nodes, while communication endpoints, temporal proximity, protocol consistency, port distance, and behavioral similarity are encoded as edge attributes. Node and edge features are jointly incorporated into attention calculation to emphasize strongly related traffic and suppress weakly relevant neighbors. Residual connections and balanced focal loss are further introduced to alleviate over-smoothing and class imbalance. Experiments on CIC-IDS2017, CSE-CIC-IDS2018, UNSW-NB15, TON_IoT, and BoT-IoT achieved Macro-F1 scores of 98.34%, 96.21%, 85.37%, 96.02%, and 96.68%, respectively. Under chronological splitting on four datasets, the method maintained an average Macro-F1 of 94.17%, outperforming GAT by 1.80 percentage points. Leakage-controlled graph construction, cross-dataset evaluation, ablation analysis, and end-to-end efficiency experiments demonstrate improved detection accuracy, minority-class recognition, generalization, and computational feasibility for offline graph-based traffic analysis.