# X-GANet: An Explainable Graph-Based Framework for Robust Network Intrusion Detection
## 3 Materials and Methods
### Constructing a Graph from the CIC-IDS2017 Dataset
The raw attention scores are then computed using the scaled dot-product:  
\[A_{ij}=e_{ij} \tag{7}\]0  
where the raw attention score matrix is computed by taking the dot-product of each query and each key and then scaling it by the square root of the embedding dimension, where \(d\) is the dimensionality of our common latent space. Invariantly, the \((i,j)\) entry of \(A_{\mathrm{raw}}\) is \(A_{\mathrm{raw},\ ij}=\frac{\mathrm{q}_{i}\cdot\mathrm{k}_{j}}{\sqrt{d}}\), with  
\[A_{ij}=e_{ij} \tag{7}\]1  
Here, \(q_{i}\) is the \(i^{\mathrm{th}}\) query vector (row \(i\) of \(F^{(l)}W^{\mathrm{Q}}\)), and \(\mathrm{k}_{j}\) is the \(j^{\mathrm{th}}\) key vector (row \(\tilde{\eta}\) of \(S^{(l)}W^{\mathrm{K}}\)). Dividing by \(\sqrt{d}\) prevents the inner products from growing too large and ensures stable gradient behavior during training. Furthermore, \(A_{\mathrm{raw}}\) is normalized via softmax to yield \(A=softmax(A_{raw})\). To incorporate the intrinsic structural relationships of both branches, we generate a diffusion mask D (see Algorithm 3) from the self-adjacency matrices derived from \(F^{(L)},S^{(L)}\). This mask modulates the attention scores elementwise:  
\[A_{ij}=e_{ij} \tag{7}\]2  
where \(\odot\) denotes elementwise multiplication. The final cross-attention output is then computed as follows:  
\[A_{ij}=e_{ij} \tag{7}\]3  
which is added to the original feature input through a residual connection, followed by layer normalization:  
\[A_{ij}=e_{ij} \tag{7}\]4  
An analogous process is applied in the structure-to-feature direction. This dual cross-diffused attention mechanism allows each view to leverage complementary information from the other while respecting its own internal structure. After \(L_{\mathrm{XDA}}\) layers, the final embeddings \(F^{(\mathrm{L})}\) and \(S^{(\mathrm{L})}\) are fused--typically via concatenation--to form a unified representation:  
\[A_{ij}=e_{ij} \tag{7}\]5  
To further enhance robustness, we introduce an entropy-based adaptive masking mechanism between the XDA block and the fusion stage. After each XDA block for each token \(i\), we compute the Shannon entropy of the cross-attention weights for every token \(i\):  
\[A_{ij}=e_{ij} \tag{7}\]6  
where \(p_{\mathrm{ij}}\) is the (softmax-normalized) attention weight. \(H_{i}\) thus quantifies the uncertainty in how token \(i\) attends to issues across the sequence. We then derive an adaptive mask weight \(m_{i}\) by comparing \(H_{i}\) to a threshold \(\tau\) via a sigmoid gating:  
\[A_{ij}=e_{ij} \tag{7}\]7  
with \(\alpha\) as a scaling factor, and \(\alpha>0\) controls the sharpness of the transition around the threshold \(\tau\). When \(H_{i}\ll\tau\), the attention is confident, so \(m_{i}\approx 1\) preserves that token's signal. Consecutively, when \(H_{i}\gg\tau\), the attention is uncertain, so \(m_{i}\approx 0\) suppresses it. We recompute \(m_{i}\) at each XDA layer, enabling the model to adaptively reweight tokens as their representations evolve. Finally, the masked output \(\widetilde{O}_{i}\) of the XDA block is obtained through the elementwise scaling of the raw XDA output \(O_{i}\):  
\[A_{ij}=e_{ij} \tag{7}\]8  
This selective attenuation selectively suppresses uncertain features and ensures that only the most informative signals and low-entropy tokens contribute to the subsequent fusion and classification stages of final intrusion detection. This fused vector is then passed through a classifier (a fully connected layer with a softmax activation) to predict whether each network flow is benign or malicious. The entire pipeline is trained end-to-end with a suitable loss function (cross-entropy loss), thereby optimizing both the encoder parameters and the XDA Transformer layers for robust intrusion detection. ```
0: Feature embeddings \(\text{F}\in\mathbb{R}^{\text{N}\times\text{d}}\), Structure embeddings \(\text{S}\in\mathbb{R}^{\text{N}\times\text{d}}\), Number of heads H
0: Updated feature embeddings \(\text{F}_{\text{out}}\in\mathbb{R}^{\text{N}\times\text{d}}\)
1.