# X-GANet: An Explainable Graph-Based Framework for Robust Network Intrusion Detection
## 3 Materials and Methods
### Constructing a Graph from the CIC-IDS2017 Dataset
\begin{table}
\begin{tabular}{l l} \hline \hline
**Attribute** & **Description** \\ \hline Flow Duration & Total duration of network flow & Continuous \\ Total Bytes & Quantity of bytes transmitted in the flow & Continuous \\ Total Packets & Number of packets in the flow & Continuous \\ Source/Destination Ports & Port numbers of the flow endpoints & Discrete \\ Protocol & Network protocol (TCP/UDP/ICMP) & Categorical \\ Packet Rate & Packets per second & Continuous \\ Avg Packet Size & Average size of packets & Continuous \\ Avg. Inter-Arrival Time & Average interval between packets & Continuous \\ Timestamp & Time of flow initiation & Temporal \\ Source/Destination IP & IP addresses involved in the flow & Categorical \\ Label & Flow label (benign or specific attack type) & Categorical \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Overview of the CIC-IDS2017 dataset. \begin{table}
\begin{tabular}{l l} \hline \hline
**Feature Branch Attributes** & **Description** \\ \hline Normalized Flow Duration & Duration scaled between 0 and 1 \\ Normalized Total Bytes & Byte count scaled between 0 and 1 \\ Normalized Total Packets & Number of packets scaled between 0 and 1 \\ Encoded Protocol Type & One-hot-encoded (TCP, UDP, ICMP) \\ Flow Rate & Packets per second \\ Average Packet Size & Average size of packets in the flow \\ Normalized Avg. Inter-Arrival Time & Time intervals scaled between 0 and 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Dataset after preprocessing. ### Setup of the Experiments

Our experimental evaluation was conducted using the preprocessed CIC-IDS2017 dataset, as described in Section 4.1. In this Section, we outline the system configuration, data preprocessing, training protocols, and hyperparameter settings that were employed to assess the performance of XGANet, with its novel Cross-Diffused Attention (XDA) module [49]. All training and data-processing experiments were implemented in PyTorch version 1.8.1 and executed on a high-performance computing platform, an Intel i7-7700K, equipped with an NVIDIA GTX 1080 Ti (Santa Clara, CA, USA) GPU and 16 GB of memory. The experiments were conducted using Ubuntu 18.04, using Python 3.8 and CUDA 10.2 to ensure computational efficiency and reproducibility [13]. Prior to model training, the dataset was partitioned into training and testing sets using an 80/20 stratified split to maintain class distribution. Data preprocessing included normalization of continuous features using min-max scaling and the construction of the graph \(\mathcal{G}=\big{(}\mathcal{V},\mathcal{E},X,\hat{A}\big{)}\), where \(\hat{A}\) is obtained via symmetric normalization [15]:

\[\hat{A}=D^{-1/2}AD^{-1/2}, \tag{35}\]

with \(D\) representing the degree matrix. This graph serves as the backbone for generating the structure branch embeddings via GNN. For both branches, raw inputs were passed through dedicated encoders to produce embeddings in a common latent space of dimension \(d\). These embeddings then served as inputs for our multi-layer XDA transformer [7]. In our experiments, we set the number of transformer layers, \(L\), to 4, with each layer consisting of multi-head cross-attention (with \(H=8\) heads) and feed-forward sub-layers. Residual connections and layer normalization were employed after each sub-layer to stabilize training and facilitate gradient flow. In the training process, we utilized the Adam optimizer with an initial learning rate of \(1\times 10^{-4}\) and a weight decay of \(5\times 10^{-5}\). The model was trained for 100 epochs with a mini-batch size of 128. Early stopping based on validation loss was implemented to prevent overfitting. Our loss function is the categorical cross-entropy, defined as

\[\mathcal{L}=-\sum_{i=1}^{C}y_{i}log(\hat{y}_{i}) \tag{36}\]

where \(C\) is the number of classes, \(y_{i}\) represents the true label, and \(\hat{y}_{i}\) denotes the predicted probability for the \(i^{\text{th}}\) class [41].