A network intrusion detection system (NIDS) plays a critical role in protecting modern networked environments, but conventional approaches often struggle to balance the detection of previously unseen attacks with a low false alarm rate. This study proposes a hybrid intrusion detection model, HybridSAGETransformerGlobal, which integrates a SAGEConv-based graph neural network (GNN) and a Transformer encoder to jointly learn local structural information and global contextual dependencies from network traffic. In the proposed framework, network flows are represented as graph nodes, and edges are constructed using IP-group-aware k-nearest neighbors (KNNs) together with a temporal chain. The model further incorporates a gated fusion mechanism, multiple positional encodings, class weighting, label smoothing, and early stopping to improve training stability and detection performance. The proposed method was evaluated under a unified preprocessing and training pipeline on two benchmark datasets, UNSW-NB15 and CIC-IDS2017, using up to approximately 100,000 flow samples per dataset, and was compared with GCN, GAT, GraphSAGE, and a Transformer-only baseline. On UNSW-NB15, repeated-run evaluation over five random seeds showed that the proposed model achieved an accuracy of 0.9841 ± 0.0006, a macro-precision of 0.9684 ± 0.0010, a macro-recall of 0.9818 ± 0.0026, and a macro-F1-score of 0.9749 ± 0.0011, with statistically significant improvements over the strongest baseline in the macro-F1-score. On CIC-IDS2017, the proposed hybrid model also showed consistently strong performance, achieving an accuracy of 0.9749, a macro-precision of 0.9513, a macro-recall of 0.9722, a macro-F1-score of 0.9613, and an ROC-AUC of 0.9957. Additional ablation, sensitivity, and baseline re-optimization analyses further supported the robustness of the proposed design. These results suggest that a coordinated hybrid architecture combining structural graph learning and long-range contextual modeling can provide an effective framework for robust flow-based network intrusion detection under the evaluated settings.

Phishing messages have evolved from simple fraud templates into socially engineered texts that exploit anxiety, trust, relational obligation, and culturally embedded norms. In Korean phishing messages, attackers frequently combine institutional authority, family or acquaintance framing, requests for cooperation, and urgency cues to induce concrete victim actions such as money transfer, link clicking, phone contact, app installation, or credential submission. However, prior studies have largely emphasized binary phishing detection while offering limited interpretability regarding how such messages mobilize social and cultural persuasion strategies. This study proposes a culturally aware large language model framework for analyzing social engineering tactics in Korean phishing messages. The framework is built on a multidimensional codebook that represents the message text, phishing label, tactic type, relation type, requested action, cultural lever, and evidence span, enabling structured and explainable analysis beyond simple classification. To operationalize this framework, an OpenChat-based model is fine-tuned with QLoRA to generate structured outputs that jointly predict the phishing status and socially relevant attributes, while evidence-span supervision is incorporated to improve grounding and explanation consistency. The evaluation examines not only phishing-detection performance but also attribute-level prediction accuracy, evidence alignment, parsing reliability, and human-rated usefulness and trustworthiness. By integrating the cultural context, relational framing, and evidence-grounded explanation into LLM-based phishing analysis, this study provides an interpretable analytical framework for Korean phishing messages and an evidence-grounded basis for analyst-supportive phishing triage. On the 82-sample authoritative clean hold-out split, Model D produced error-free label predictions and achieved 0.841 exact-match core and 0.886 span-F1. However, because the evaluation used a single 82-sample internal hold-out split and no independent external corpus, these results should be interpreted as feasibility evidence under leakage-controlled conditions rather than as proof of deployment-level robustness or cross-domain generalization. The main contribution of this study is therefore not improved binary detection over strong lexical baselines, but the structured and evidence-grounded representation of Korean phishing persuasion tactics for analyst-supportive triage.