To address the class imbalance issue in network intrusion detection, which degrades performance of intrusion detection models, this paper proposes a novel generative model called VAE-WACGAN to generate minority class samples and balance the dataset. This model extends the Variational Autoencoder Generative Adversarial Network (VAEGAN) by integrating key features from the Auxiliary Classifier Generative Adversarial Network (ACGAN) and the Wasserstein Generative Adversarial Network with Gradient Penalty (WGAN-GP). These enhancements significantly improve both the quality of generated samples and the stability of the training process. By utilizing the VAE-WACGAN model to oversample anomalous data, more realistic synthetic anomalies that closely mirror the actual network traffic distribution can be generated. This approach effectively balances the network traffic dataset and enhances the overall performance of the intrusion detection model. Experimental validation was conducted using two widely utilized intrusion detection datasets, UNSW-NB15 and CIC-IDS2017. The results demonstrate that the VAE-WACGAN method effectively enhances the performance metrics of the intrusion detection model. Furthermore, the VAE-WACGAN-based intrusion detection approach surpasses several other advanced methods, underscoring its effectiveness in tackling network security challenges.

Large-scale botnet detection using graph neural networks (GNNs) often requires subgraph sampling to reduce computational and memory costs. However, conventional sampling strategies may fail to simultaneously preserve the global topology and local community structure of the original graph, resulting in structural information loss. To address this issue, this paper proposes RI Graph Sampling (RIGS), a hybrid graph sampling method that probabilistically combines Rank Degree (RD) sampling with Improved Forest Fire Sampling based on PageRank (IFFST-PR). By exploiting the complementary structural preferences of these two strategies, RIGS preserves structurally important nodes and local community information while controlling computational overhead. RIGS is further integrated into the GraphSAINT training framework, where sampling normalization is employed to reduce the estimation bias introduced by stochastic subgraph sampling. When combined with a Graph Convolutional Network (GCN), the proposed framework alleviates the neighbor explosion problem and improves training efficiency while maintaining competitive detection performance. Experiments on the CTU-13 and NCC-2 datasets demonstrate that the proposed framework reduces training time and memory consumption while achieving competitive botnet detection performance. Structural preservation analysis further shows that RIGS provides a favorable balance between global topology and local community structure. Overall, the proposed framework achieves a favorable trade-off among detection performance, computational efficiency, and structural preservation, supporting its applicability to large-scale botnet detection.