XMF-GNN: A cross-modality dynamic fusion heterogeneous graph neural network for network intrusion detection

With the rapid development of the Internet, network attacks have become increasingly complex and covert. However, most existing intrusion detection methods focus on extracting static features from a single modality, making it difficult to fully exploit the complementary information across different modalities. Furthermore, these methods often lack structure-awareness and adaptive feature fusion capabilities when modeling complex attack behaviors, resulting in limited effectiveness in detecting diverse intrusion patterns. To address these challenges, we propose XMF-GNN, a heterogeneous graph neural network (HGNN) model enhanced with a cross-modality attention fusion mechanism. This model constructs a heterogeneous graph representation based on flow and packet modalities of network traffic, and employs an attention-driven modality fusion mechanism to dynamically learn the importance weights between modalities, enabling adaptive cross-modal feature fusion. The model architecture consists of a two-layer heterogeneous graph convolutional encoder and a modality attention module, which together effectively capture the intricate relationships between traffic flows and payload data in complex network environments. Experiments are conducted on two publicly available network intrusion detection datasets, CIC-IDS2017 and CIC-IoT2023. The results show that the proposed model achieves an F1 score of 0.977 on CIC-IDS2017 and an even higher F1 score of 0.985 on CIC-IoT2023 in multi-class classification tasks. It also significantly outperforms state-of-the-art methods in terms of accuracy and other mainstream evaluation metrics, demonstrating the effectiveness and robustness of the proposed cross-modality fusion mechanism in handling complex intrusion detection scenarios. XMF-GNN detects network intrusions by turning flow and packet data into a heterogeneous graph, then using HGNN and attention-based fusion to make accurate decisions. • A novel XMF-GNN framework fuses flow and packet data via dual-layer heterogeneous GNN. • An attention-based fusion mechanism adaptively integrates multimodal network features. • Extensive experiments validate XMF-GNN’s advantage over existing fusion methods.