Hierarchical graph attention and memory-augmented learning for spatio-temporal network intrusion detection

Graph neural networks are increasingly used for network intrusion detection, but their reported advantages often depend on evaluation choices. We present STAR-IDS, which builds a graph from every window of ten consecutive network flows, applies two-level graph attention and a prototype memory bank, and estimates prediction uncertainty with Monte Carlo Dropout. STAR-IDS was evaluated on NF-CSE-CIC-IDS2018-v3, with real IP-address nodes and flows ordered by start time, and on the IoT dataset NF-ToN-IoT-v2, using block-wise splits that prevent leakage, temporally blocked cross-validation, five paired seeds and controlled baselines (E-GraphSAGE, GAT, GCN, GraphSAGE and a graph-free MLP) trained under identical conditions. On NF-CSE-CIC-IDS2018, STAR-IDS achieved 87.61% ± 1.22% accuracy and 86.41% macro-F1, and no difference from the baselines or ablations was statistically significant after Holm correction; on NF-ToN-IoT, the graph-free MLP was the most accurate model (81.10% vs. 77.21%). The uncertainty estimates separated erroneous from correct predictions with an AUC of 0.89, and on that dataset flagged predictions were 16–25 percentage points less accurate than auto-accepted ones. Control experiments show that shuffling flows before windowing, synthetic node identifiers and forward-in-time splits change accuracy by up to 68 percentage points.