  A network intrusion usually involves a number of network locations. Data flow
(including the data generated by intrusion behaviors) among these locations
(usually represented by IP addresses) naturally forms a graph. Thus, graph
neural networks (GNNs) have been used in the construction of intrusion
detection models in recent years since they have an excellent ability to
capture graph topological features of intrusion data flow. However, existing
GNN models treat node mean aggregation equally in node information aggregation.
In reality, the correlations of nodes and their neighbors as well as the linked
edges are different. Assigning higher weights to nodes and edges with high
similarity can highlight the correlation among them, which will enhance the
accuracy and expressiveness of the model. To this end, this paper proposes
novel Edge-Directed Graph Multi-Head Attention Networks (EDGMAT) for network
intrusion detection. The proposed EDGMAT model introduces a multi-head
attention mechanism into the intrusion detection model. Additional weight
learning is realized through the combination of a multi-head attention
mechanism and edge features. Weighted aggregation makes better use of the
relationship between different network traffic data. Experimental results on
four recent NIDS benchmark datasets show that the performance of EDGMAT in
terms of weighted F1-Score is significantly better than that of four
state-of-the-art models in multi-class detection tasks.
