Abstract: Intrusion detection is a network security technology used to monitor and discover malicious activity or violations of security policies in a network or system. The existing detection methods perform well when dealing with uniformly distributed network data. However, the data distribution in the actual network environment is often unbalanced. In this case, the existing methods have insufficient feature extraction for a few class attack data, resulting in a significant decline in detection performance. In order to solve the above problems, an intrusion detection method to improve GraphSAGE is proposed. Firstly, the data is preprocessed and converted into a graph structure. Secondly, in order to improve the feature extraction ability, graph pooling sampling and LSTM-GRU method are used to collect time features, learn feature representation and aggregate them. Finally, the features are sent to the classifier and converted into category probabilities for classification. Comparative experiments are carried out on the dataset UNSW-NB15 and NSL_KDD, and the results show that the proposed method improves the detection accuracy compared with the existing model in the detection of unbalanced data, and the accuracy of the multi-classification detection on the dataset UNSW-NB15 and NSL_KDD reaches 0.992 and 0.995, respectively.