In the context of the continuous development of intelligent IoT systems, the utilization of graph structures for the detection of various security applications has become crucial, especially in the face of novel adversarial attacks. However, there is a significant challenge due to the class and feature imbalances in graph data generated by abnormal adversarial activities. This imbalance is particularly pronounced in multi-class graph datasets originated from IoT system because of the scarcity of samples in minority classes, such as anomalies or malicious activities, and the further exacerbation of feature sparsity during the training process. Additionally, the presence of low-quality features significantly diminishes the model’s classification performance. Considering these problems above, we propose a Stacked Classifier with Feature Augmentation (SCFA) model based on graph neural networks, employing multi-head attention mechanisms to dynamically weight neighborhood importance for enhanced feature representation. Furthermore, we introduce an alternating composition mechanism to progressively extract high-order features while effectively integrating them with low-level features. By implementing a stacked classifier strategy, we leverage the complementary advantages of multiple weak classifiers to significantly improve the model’s generalization capacity and overall performance. Experiments on two commonly utilized public graph datasets validate the effectiveness of SCFA, showing significant improvements in accuracy, F1 score, and AUC metrics.