{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,2]],"date-time":"2026-08-02T19:48:56Z","timestamp":1785700136021,"version":"3.56.0"},"reference-count":42,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100008081","name":"Southeast University","doi-asserted-by":"publisher","award":["RF1028623059"],"award-info":[{"award-number":["RF1028623059"]}],"id":[{"id":"10.13039\/501100008081","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100025517","name":"Big Data Computing Center, Southeast University","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100025517","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100013804","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100013804","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["2242025K30025"],"award-info":[{"award-number":["2242025K30025"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Engineering Applications of Artificial Intelligence"],"published-print":{"date-parts":[[2026,10]]},"DOI":"10.1016\/j.engappai.2026.115284","type":"journal-article","created":{"date-parts":[[2026,6,4]],"date-time":"2026-06-04T17:57:53Z","timestamp":1780595873000},"page":"115284","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"P1","title":["Network intrusion detection with edge-directed graph Multi-Head Attention Networks"],"prefix":"10.1016","volume":"181","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-9637-651X","authenticated-orcid":false,"given":"Xiang","family":"Li","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Haiyang","family":"Diao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9258-9929","authenticated-orcid":false,"given":"Yali","family":"Yuan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2541-4923","authenticated-orcid":false,"given":"Jing","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"issue":"1","key":"10.1016\/j.engappai.2026.115284_b1","article-title":"Network intrusion detection system: A systematic study of machine learning and deep learning approaches","volume":"32","author":"Ahmad","year":"2021","journal-title":"Trans. Emerg. Telecommun. Technol."},{"key":"10.1016\/j.engappai.2026.115284_b2","doi-asserted-by":"crossref","first-page":"165130","DOI":"10.1109\/ACCESS.2020.3022862","article-title":"TON_IoT telemetry dataset: A new generation dataset of IoT and iiot for data-driven intrusion detection systems","volume":"8","author":"Alsaedi","year":"2020","journal-title":"IEEE Access"},{"issue":"4","key":"10.1016\/j.engappai.2026.115284_b3","doi-asserted-by":"crossref","first-page":"5152","DOI":"10.1109\/TNSM.2022.3157344","article-title":"The cross-evaluation of machine learning-based network intrusion detection systems","volume":"19","author":"Apruzzese","year":"2022","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"10.1016\/j.engappai.2026.115284_b4","series-title":"AI* IA 2016 Advances in Artificial Intelligence: XVth International Conference of the Italian Association for Artificial Intelligence, Genova, Italy, November 29\u2013December 1, 2016, Proceedings XV","first-page":"283","article-title":"A comparative study of inductive and transductive learning with feedforward neural networks","author":"Bianchini","year":"2016"},{"key":"10.1016\/j.engappai.2026.115284_b5","series-title":"Graph-based solutions with residuals for intrusion detection: The modified e-graphsage and e-resgat algorithms","author":"Chang","year":"2021"},{"issue":"2","key":"10.1016\/j.engappai.2026.115284_b6","doi-asserted-by":"crossref","first-page":"446","DOI":"10.3390\/s21020446","article-title":"An experimental analysis of attack classification using machine learning in IoT networks","volume":"21","author":"Churcher","year":"2021","journal-title":"Sensors"},{"key":"10.1016\/j.engappai.2026.115284_b7","doi-asserted-by":"crossref","first-page":"928","DOI":"10.1109\/TDSC.2018.2821693","article-title":"Adaptive performance anomaly detection in distributed systems using online SVMs","volume":"17","author":"Cid-Fuentes","year":"2020","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"10.1016\/j.engappai.2026.115284_b8","doi-asserted-by":"crossref","DOI":"10.1016\/j.jnca.2021.103160","article-title":"A novel hybrid model for intrusion detection systems in SDNs based on CNN and a new regularization technique","volume":"191","author":"Elsayed","year":"2021","journal-title":"J. Netw. Comput. Appl."},{"key":"10.1016\/j.engappai.2026.115284_b9","series-title":"2018 20th International Conference on Advanced Communication Technology","first-page":"178","article-title":"A deep auto-encoder based approach for intrusion detection system","author":"Farahnakian","year":"2018"},{"key":"10.1016\/j.engappai.2026.115284_b10","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1016\/j.cose.2008.08.003","article-title":"Anomaly-based network intrusion detection: Techniques, systems and challenges","volume":"28","author":"Garc\u00eda-Teodoro","year":"2009","journal-title":"Comput. Secur."},{"key":"10.1016\/j.engappai.2026.115284_b11","doi-asserted-by":"crossref","first-page":"234","DOI":"10.1016\/j.cose.2019.02.008","article-title":"CorrCorr: A feature selection method for multivariate correlation network anomaly detection techniques","volume":"83","author":"Gottwalt","year":"2019","journal-title":"Comput. Secur."},{"key":"10.1016\/j.engappai.2026.115284_b12","article-title":"Inductive representation learning on large graphs","volume":"30","author":"Hamilton","year":"2017","journal-title":"Adv. Neural Inf. Process. Syst."},{"issue":"12","key":"10.1016\/j.engappai.2026.115284_b13","doi-asserted-by":"crossref","first-page":"5349","DOI":"10.1109\/TNNLS.2020.2966319","article-title":"Why resnet works? residuals generalize","volume":"31","author":"He","year":"2020","journal-title":"IEEE Trans. Neural Networks Learn. Syst."},{"key":"10.1016\/j.engappai.2026.115284_b14","doi-asserted-by":"crossref","first-page":"183207","DOI":"10.1109\/ACCESS.2019.2959131","article-title":"A novel multimodal-sequential approach based on multi-view features for network intrusion detection","volume":"7","author":"He","year":"2019","journal-title":"IEEE Access"},{"issue":"1","key":"10.1016\/j.engappai.2026.115284_b15","first-page":"83","article-title":"A survey of intrusion detection using deep learning in internet of things","volume":"3","author":"Jasim","year":"2022","journal-title":"Iraqi J. Comput. Sci. Math."},{"key":"10.1016\/j.engappai.2026.115284_b16","series-title":"2022 International Conference on Electronics, Information, and Communication","first-page":"1","article-title":"A graph embedding-based identity inference attack on blockchain systems","author":"Kim","year":"2022"},{"key":"10.1016\/j.engappai.2026.115284_b17","doi-asserted-by":"crossref","first-page":"779","DOI":"10.1016\/j.future.2019.05.041","article-title":"Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset","volume":"100","author":"Koroniotis","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"10.1016\/j.engappai.2026.115284_b18","doi-asserted-by":"crossref","first-page":"110","DOI":"10.1016\/j.comcom.2020.12.003","article-title":"An ensemble learning and fog-cloud architecture-driven cyber-attack detection framework for IoMT networks","volume":"166","author":"Kumar","year":"2021","journal-title":"Comput. Commun."},{"issue":"9","key":"10.1016\/j.engappai.2026.115284_b19","doi-asserted-by":"crossref","first-page":"6358","DOI":"10.1109\/TII.2022.3142030","article-title":"P2tif: A blockchain and deep learning framework for privacy-preserved threat intelligence in industrial iot","volume":"18","author":"Kumar","year":"2022","journal-title":"IEEE Trans. Ind. Informatics"},{"issue":"10","key":"10.1016\/j.engappai.2026.115284_b20","doi-asserted-by":"crossref","first-page":"1565","DOI":"10.3390\/electronics9101565","article-title":"An anomaly mitigation framework for iot using fog computing","volume":"9","author":"Lawal","year":"2020","journal-title":"Electronics"},{"issue":"5","key":"10.1016\/j.engappai.2026.115284_b21","doi-asserted-by":"crossref","DOI":"10.14704\/nq.2018.16.5.1391","article-title":"Using a recurrent neural network and restricted Boltzmann machines for malicious traffic detection","volume":"16","author":"Li","year":"2018","journal-title":"NeuroQuantology"},{"issue":"4","key":"10.1016\/j.engappai.2026.115284_b22","first-page":"1591","article-title":"Sustainable ensemble learning driving intrusion detection model","volume":"18","author":"Li","year":"2021","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"10.1016\/j.engappai.2026.115284_b23","doi-asserted-by":"crossref","first-page":"16","DOI":"10.1016\/j.jnca.2012.09.004","article-title":"Intrusion detection system: A comprehensive review","volume":"36","author":"Liao","year":"2013","journal-title":"J. Netw. Comput. Appl."},{"key":"10.1016\/j.engappai.2026.115284_b24","first-page":"1","article-title":"E-graphsage: A graph neural network based intrusion detection system for IoT","author":"Lo","year":"2021","journal-title":"NOMS 2022-2022 IEEE\/IFIP Netw. Oper. Manag. Symp."},{"key":"10.1016\/j.engappai.2026.115284_b25","doi-asserted-by":"crossref","first-page":"262","DOI":"10.1145\/382912.382923","article-title":"Testing intrusion detection systems: a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by lincoln laboratory","volume":"3","author":"McHugh","year":"2000","journal-title":"ACM Trans. Inf. Syst. Secur."},{"issue":"3","key":"10.1016\/j.engappai.2026.115284_b26","doi-asserted-by":"crossref","first-page":"1531","DOI":"10.1109\/LRA.2023.3234771","article-title":"Scene: Reasoning about traffic scenes using heterogeneous graph neural networks","volume":"8","author":"Monninger","year":"2023","journal-title":"IEEE Robot. Autom. Lett."},{"key":"10.1016\/j.engappai.2026.115284_b27","unstructured":"Nagaraja, S., Mittal, P., Hong, C.-Y., Caesar, M., Borisov, N., 2010. BotGrep: finding P2P bots with structured graph analysis. In: Proceedings of the 19th USENIX Conference on Security. p. 7."},{"key":"10.1016\/j.engappai.2026.115284_b28","doi-asserted-by":"crossref","first-page":"139","DOI":"10.1016\/j.comcom.2020.05.048","article-title":"An effective feature engineering for DNN using hybrid PCA-gwo for intrusion detection in IoMT architecture","volume":"160","author":"RM","year":"2020","journal-title":"Comput. Commun."},{"key":"10.1016\/j.engappai.2026.115284_b29","series-title":"Big Data Technologies and Applications: 10th EAI International Conference, BDTA 2020, and 13th EAI International Conference on Wireless Internet, WiCON 2020, Virtual Event, December 11, 2020, Proceedings 10","first-page":"117","article-title":"Netflow datasets for machine learning-based network intrusion detection systems","author":"Sarhan","year":"2021"},{"issue":"1","key":"10.1016\/j.engappai.2026.115284_b30","doi-asserted-by":"crossref","first-page":"41","DOI":"10.1109\/TETCI.2017.2772792","article-title":"A deep learning approach to network intrusion detection","volume":"2","author":"Shone","year":"2018","journal-title":"IEEE Trans. Emerg. Top. Comput. Intell."},{"key":"10.1016\/j.engappai.2026.115284_b31","doi-asserted-by":"crossref","first-page":"129","DOI":"10.1016\/j.eswa.2011.06.013","article-title":"Decision tree based light weight intrusion detection using a wrapper approach","volume":"39","author":"Sindhu","year":"2012","journal-title":"Expert Syst. Appl."},{"key":"10.1016\/j.engappai.2026.115284_b32","series-title":"2022 IEEE 24th International Workshop on Multimedia Signal Processing","first-page":"1","article-title":"Structural identity representation learning of blockchain transaction network for metaverse","author":"Tao","year":"2022"},{"key":"10.1016\/j.engappai.2026.115284_b33","series-title":"Graph attention networks","author":"Velickovic","year":"2017"},{"issue":"4","key":"10.1016\/j.engappai.2026.115284_b34","doi-asserted-by":"crossref","first-page":"4436","DOI":"10.1109\/TIA.2020.2971952","article-title":"A visualized botnet detection system based deep learning for the internet of things networks of smart cities","volume":"56","author":"Vinayakumar","year":"2020","journal-title":"IEEE Trans. Ind. Appl."},{"key":"10.1016\/j.engappai.2026.115284_b35","series-title":"Artificial Neural Networks and Machine Learning \u2013 ICANN 2021","first-page":"253","article-title":"EGAT: Edge-featured graph attention network","author":"Wang","year":"2021"},{"key":"10.1016\/j.engappai.2026.115284_b36","series-title":"Computational Science\u2013ICCS 2020: 20th International Conference, Amsterdam, the Netherlands, June 3\u20135, 2020, Proceedings, Part IV 20","first-page":"156","article-title":"Towards network anomaly detection using graph embedding","author":"Xiao","year":"2020"},{"key":"10.1016\/j.engappai.2026.115284_b37","doi-asserted-by":"crossref","first-page":"21954","DOI":"10.1109\/ACCESS.2017.2762418","article-title":"A deep learning approach for intrusion detection using recurrent neural networks","volume":"5","author":"Yin","year":"2017","journal-title":"IEEE Access"},{"key":"10.1016\/j.engappai.2026.115284_b38","article-title":"An improved network intrusion detection based on deep neural network","volume":"vol. 563","author":"Zhang","year":"2019"},{"key":"10.1016\/j.engappai.2026.115284_b39","doi-asserted-by":"crossref","first-page":"1428","DOI":"10.1016\/j.comcom.2005.01.014","article-title":"Application of online-training SVMs for real-time intrusion detection with different considerations","volume":"28","author":"Zhang","year":"2005","journal-title":"Comput. Commun."},{"key":"10.1016\/j.engappai.2026.115284_b40","article-title":"Intrusion detection of industrial internet-of-things based on reconstructed graph neural networks","author":"Zhang","year":"2022","journal-title":"IEEE Trans. Netw. Sci. Eng."},{"key":"10.1016\/j.engappai.2026.115284_b41","series-title":"Automating botnet detection with graph neural networks","author":"Zhou","year":"2020"},{"issue":"4","key":"10.1016\/j.engappai.2026.115284_b42","doi-asserted-by":"crossref","first-page":"993","DOI":"10.3390\/electronics12040993","article-title":"Detecting phishing accounts on ethereum based on transaction records and EGAT","volume":"12","author":"Zhou","year":"2023","journal-title":"Electronics"}],"container-title":["Engineering Applications of Artificial Intelligence"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S095219762601568X?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S095219762601568X?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,8,2]],"date-time":"2026-08-02T19:03:58Z","timestamp":1785697438000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S095219762601568X"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,10]]},"references-count":42,"alternative-id":["S095219762601568X"],"URL":"https:\/\/doi.org\/10.1016\/j.engappai.2026.115284","relation":{},"ISSN":["0952-1976"],"issn-type":[{"value":"0952-1976","type":"print"}],"subject":[],"published":{"date-parts":[[2026,10]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Network intrusion detection with edge-directed graph Multi-Head Attention Networks","name":"articletitle","label":"Article Title"},{"value":"Engineering Applications of Artificial Intelligence","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.engappai.2026.115284","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier Ltd. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"115284"}}