The current deep learning methods for intrusion detection primarily employ graph neural networks (GNNs), but they face two major issues. First, they rarely account for differences between devices in network communication, treating all devices equally. Second, the same detection model is used across different detection stages, without adapting models to distinct data characteristics at each stage. To address these issues, this paper proposes a novel Network Intrusion Detection System(NIDS) framework featuring a two-stage neural network framework based on device network address characteristics. The first layer model, Add-EGraphSAGE, is based on a graph neural network and aims to detect anomalous network traffic. The second layer model, Add-MLPMixer, leverages a multi-layer perceptron to classify specific attack types within the detected anomalous traffic. We conduct extensive experimental evaluations on three authoritative NIDS benchmark datasets: UNSW-NB15, NF-BoT-IoT, and NF-ToN-IoT. The results demonstrate that device address characteristics indeed contain valuable information, proving the potential applicability of the proposed framework. In the binary classification experiments, the Add-EGraphSAGE model within our framework achieved notable improvements on two of the datasets, with an F1-score increase of 0.82% on the NF-BoT-IoT dataset. In multi-class classification experiments, the Add-MLPMixer model in our framework consistently outperformed others, achieving an F1-score improvement of up to 9.13% on the NF-ToN-IoT dataset.