ADA-GNetIDS: ADASYN-augmented graph neural network based learning in IDS for robust cyber attack classification

Class imbalance and high-dimensional flow features remain important challenges in learning-based intrusion detection. This study presents ADA-GNetIDS, a reproducible pipeline that combines training-only ADASYN oversampling, mutual-information feature selection, a cosine-similarity anchor graph, and a dual-branch graph neural network. Each network-flow record is represented as a node. Up to 25,000 stratified anchor nodes form a global backbone through 15-nearest-neighbour search, while every non-anchor node is connected to its five nearest anchors; edges with cosine similarity below 0.50 are discarded. Three GraphSAGE layers and three GATConv layers independently encode the same graph, and node-wise learned scalar weights fuse their outputs before classification. Evaluation uses per-class order-preserving 70/10/20 train/validation/test partitions, with scaling and feature selection fitted only on training data and ADASYN applied only to that partition. On CICIDS2017 Tuesday, Wednesday, Thursday, and CICIoT2023, the full configuration obtains accuracies of 99.63%, 91.62%, 97.94%, and 98.16%, respectively. The ablation results are mixed: some reduced configurations outperform the full configuration on individual datasets, while removal of attention causes a large reduction on Tuesday for CICIDS2017 dataset.