Large-Scale Network Traffic Classification Using Graph Clustering-Enhanced E-GraphSAGE

Abstract

Network traffic classification is a key technology for intrusion detection systems, but traditional methods face bottlenecks such as high computational complexity and large memory consumption when handling large-scale graph-structured data. To address this challenge, this paper proposes the Cluster-E-GraphSAGE framework, which innovatively combines edge-aware graph neural networks with the METIS graph partitioning algorithm to achieve efficient processing of large-scale network traffic graphs through an efficient subgraph partitioning strategy and edge-aware message passing mechanism. The framework supports multi-directed graph structures, completely preserving edge multiplicity and feature attributes, and significantly reduces computational complexity and memory overhead through edge-based subgraph partitioning. Experiments on the standard NF-BoT-IoT and NF-ToN-IoT datasets show that Cluster-E-GraphSAGE performs particularly well in multi-class classification tasks, achieving F1 scores of 92.82% and 81.32% respectively, which are 11.23% and 23.6% improvements over baseline methods. Meanwhile, it reduces memory usage by 4-7 times and GPU memory by 8-11 times. The research results verify that the method maintains high classification accuracy while significantly reducing memory overhead in resource-constrained environments, demonstrating its application potential in real-time intrusion detection scenarios.