MGF-GNN: A Multi-Granularity Graph Fusion-based Graph Neural Network Method for Network Intrusion Detection

With the increasing complexity and diversity of network attacks, Graph Neural Networks (GNNs) have been employed to address network intrusion detection challenges. However, the performance of these models is constrained by their reliance on a single graph construction approach. To enhance detection accuracy and adaptability to intricate attack patterns, this paper introduces a Multi-Granularity Graph Fusion-based Graph Neural Network (MGF-GNN) model. The model resolves the issue of a single granularity graph structure failing to fully capture the complex relationships and covert attack strategies in network traffic. It constructs three heterogeneous graphs at different granularities to capture traffic relationships from host-level, port-level, and protocol-level perspectives. The model employs hierarchical message passing, aggregation, and cross-graph information fusion mechanisms to strengthen its ability to learn multi-level information, thereby improving detection performance against complex attacks. MGF-GNN outperforms traditional machine learning methods and single-graph-based GNN models on the CIC-IDS2017 and UNSW-NB15 datasets, achieving significant improvements across multiple evaluation metrics, including accuracy, precision, recall, and F1 score. Its effectiveness is primarily attributed to MGF-GNN's ability to comprehensively learn multi-dimensional perspective information through multi-granularity graph fusion.