Contemporary network intrusion detection systems (NIDS) need to be able to classify various types of attacks

in the high-dimensional, highly skewed network traffic. In this paper, a hybrid RF-PGNN framework will be

presented, which combines a Random Forest (RF) and a Graph Attention Network (GAT) to utilize both feature-

level discriminative patterns and sample-level relational structure. Similarities of RF leaf-assignments are

passage of messages, as well as to the limitation of proximity-based edges to the encoding of directed flow

semantics of fine-grained attack sub-types; however, the complementary relational signal that it provides can

provide a consistent ensemble boost. The McNemar test shows that the RF baseline gain is significant (p < 0.05).

Additional testing with an unequal class distribution suggests that RF-PGNN recovers macro F1 on classes that

are attacked by minorities, implying that it can be used in practice even at suboptimal benchmarks like equal

classes. The suggested framework provides a theoretically sound tool to integrate tree ensembles and graph-

based learning to promote the further development of multi-class intrusion detection without losing

interpretability.

Keywords— Random Forest, Network Intrusion Detection, Proximity Graph, Graph Neural Networks, Feature

Selection, Ensemble Learning, Imbalanced Classification

strength and capability to operate with high-dimensional data. However, RF models model individual samples

disregarding the possible connections between network flows, which is a weakness as attacks can typically happen

in a sequence or can concern multiple hosts.

The most recent developments in Graph Neural Networks (GNNs) provide an opportunity to learn sample-wise

dynamics, working on graphs. Non-trivially, however, when applied to tabular data, GNNs need to build

meaningful graph. The available approaches tend to be based on feature-based k nearest neighbours graphs which

do not necessarily reflect actual underlying relationships, which a robust classifier such as RF has learnt.

This paper is going to suggest an innovative hybrid method that integrates Random Forest and a Graph Attention

Network (GAT) to solve these problems. Training an RF. The first step is to build a proximity graph using the

similarities in the leaf-assignments of the RF, with edges between samples whose probability of finding

The recent contributions to network intrusion detection have investigated diverse machine learning and deep

learning models, including ensemble models, random forest-based models, graph neural networks, and hybrid

designs. Ensemble techniques have been specifically promising, with one paper combining several algorithms

such as XGBoost, Random Forest, Graph Neural Networks, LSTM, and Autoencoders in a weighted soft-voting

ensemble which obtained near-perfect results on a large-scale dataset [1]. A different paper used convolutional

neural networks with a binary multi-objective enhanced gorilla troops optimizer to perform feature selection and

obtain an accuracy of more than 99.8% on benchmark datasets [2]; something also done with CNN and a binary

multi-objective enhanced capuchin search algorithm [3]. Botnet detection in IoT networks has been solved also

using metaheuristic optimization, which proves to be more precise and recall [4].

Graph neural networks have become popular to model the dependence in network traffic. An overall survey has

shown GNNs to be useful in the recognition of patterns of communication between hosts [7] and later studies

have shown that GNNs are capable of detecting anomalies that cannot be detected by traditional classifiers [8].

IoT intrusion detection Privacy-preserving federated learning has been considered with graph-based approaches

[9], and adversarial robustness of GNN-based IDS has also been researched [10]. Lightweight deep learning

models that optimize the usage of IoT settings have been suggested to be used in real-time applications [11], as

well as adaptive strategies to online anomaly detection [12].

One of the most important issues with the use of GNNs on tabular data is the creation of meaningful graphs. A

current study has proposed RF -GNN, which converts tabular data to a graph with the help of Random Forest

proximities - similarity between sample pairs, based on the frequency of landing in the same leaf nodes of the

GNNs to detect multiple classes of intrusions. The RF -GNN strategy has potential underpinning but has not been

applied to imbalanced, multi-class environments. Besides, the theory indicates RF-proximity graphs can provide

a better alternative to the traditional k-NN graphs in the classification of tabular data. This paper fills this gap by

introducing a hybrid model that uses the similarities in the leaf-assignments of the Random Forest to construct a

graph, which a Graph Attention Network is trained on, and the two models are weighted to obtain a high accuracy

in the identification of different types of attacks.

The experiments are conducted on the CIC-IDS2017 dataset, a widely adopted intrusion detection benchmark

comprising realistic network traffic traces that include both normal activity and diverse attack scenarios. The raw

balanced subset of 13,636 samples in total. Feature selection is performed using SelectKBest with the f-classif

criterion, retaining the top 15 most informative features. The balanced dataset is divided into stratified training

and testing sets (80%/20%) to maintain class proportions. It is acknowledged that this undersampling strategy

does not replicate real-world NIDS conditions where class imbalance is pervasive. To address this limitation, a

secondary evaluation under a constrained imbalanced regime (maximum 10:1 class ratio) is presented in the

Discussion section to assess the practical applicability of RF-PGNN beyond balanced benchmarks.

The proposed system, which is called RF -Proximity Graph Neural Network (RF-PGNN), combines a Random

Forest (RF) and a Graph Attention Network (GAT) to utilize sample-level and feature-level connections. As

shown in Figure 1, the architecture consists of six phases, (1) data preprocessing, (2) RF training, (3) leaf-

dimensional data, and default assignment of leaf-vectors. The forest is trained on the processed training data (60

percent of balanced dataset). It is a combination of 100 decision trees that are constructed using a bootstrap sample.

During every split, the size of the features to be used is sqrt(n_features) so as to avoid redundancy. Table I shows

the hyperparameters. The trained RF has two important functions: (i) it acts as a powerful baseline classifier with

almost perfect accuracy, and (ii) its internal representation; the number of leaf indices per tree can be later used

to construct a similarity graph which gives an idea of the decision boundaries the forest learnt. This is one of the

raw features. The trained RF will produce a leaf indices (per tree) vector of each sample. The reasoning is that

when two samples keep on popping up in the same leaf over many trees, then they tend to be similar in a manner

that is significant in the task of classification because the forest has already learned to cluster them. The intimacy

of samples i and j is determined as the fraction of trees where they have common leaves:

Where 𝑇 = 100 and 𝟏[⋅] is the indicator function. This measure captures non-linear feature interactions that are

implicitly learned by the forest.

In order to get a sparse graph to train on GNN, we compute the Hamming distance 𝑑(𝑖, 𝑗) = 1 − 𝑝𝑟𝑜𝑥𝑖𝑚𝑖𝑡𝑦(𝑖, 𝑗)

and connect each node to its k nearest neighbours. The parameter k is tuned through validation, 10, 20, and 30

were tried, and 𝑘 = 30 gives optimization of GAT. This graph is illustrated by an edge index with shape

GAT, even with its average standalone performance, gives an additional signal which propels the ensemble to

practically an ideal performance.

leaf co-occurrence measure performs well to encode the total non-linear classes boundaries, however, it does not

RF, which precisely makes the weighted ensemble outperform either of the two models alone.

of the ensemble is 98.94, macro F1=0.9894, and ROC-AUC macro=0.9986, which is better than the standalone

RF in all three metrics. The ensemble confusion matrix (Figure 4) attests to the fact that the GAT refinement does

indeed correct some of the RF errors: class 4 samples that were previously incorrectly classified as class 3 (10

errors) are being 4, and errors to class 6 are being 4, with a total of 7 errors on the test. This relative change is

insignificant, but in practice when applied in context of security, the implication is of the fact that every mis-