# X-GANet: An Explainable Graph-Based Framework for Robust Network Intrusion Detection
## 3 Materials and Methods
### Constructing a Graph from the CIC-IDS2017 Dataset
In Equation (3), the superscript IP indicates IP-based adjacency. Furthermore, we set  
\[A_{ij}^{\text{IP}}= \begin{cases}1,&\text{if }f_{i}\text{ and }f_{j}\text{ share any endpoint IP, i.e.,}\\ &\left(\text{src\_IP}_{i}=\text{src\_IP}_{j}\right)\ \vee\ \left(\text{src\_IP}_{i}=\text{dst\_IP}_{j}\right)\ \vee\\ &\left(\text{dst\_IP}_{i}=\text{src\_IP}_{j}\right)\ \vee\ \left(\text{dst\_IP}_{i}=\text{dst\_IP}_{j} \right),\\ 0,&\text{otherwise}.\end{cases}  \tag{4}\]  
The above formula links any two flows that share a common source or destination IP address, capturing host-level relationships in the graph. To capture short-term dependencies in network activity, we connect flows that occur within a predefined time-window \(\Delta t\)[42]:  
\[e_{ij}= \begin{cases}1,&\text{if }\mid t_{i}-t_{j}\mid\leq\Delta t,\\ 0,&\text{otherwise}.\end{cases}  \tag{5}\]  
where \(t_{i}\) and \(t_{j}\) denote the timestamps of flows \(f_{i}\) and \(f_{j}\). This connectivity is particularly useful in detecting DDoS attacks, where multiple attack flows are initiated within a short time frame. To capture both host-level and temporal dependencies, we define the final adjacency,  
\[e_{ij}=A_{ij}^{\text{IP}}\ \vee\ \ A_{ij}^{\Delta t} \tag{6}\]  
where an edge is present if either IP-based or time-window-based connectivity holds. Neither rule overrides the other; flows satisfying both still yield a single edge. Once edges are established, we construct the adjacency matrix \(A\), where  
\[A_{ij}=e_{ij} \tag{7}\]  
To stabilize learning in graph convolutional processing, we introduce the degree matrix \(\mathrm{D}\), which stores the number of connections each node has:  
\[D_{ii}=\sum_{j}A_{ij} \tag{8}\]  
Therefore, at the start of training, \(i=0,\ F^{(0)}=E_{f}(F_{\text{raw}})\) and \(S^{(0)}=E_{s}(S_{\text{raw}})\) are the direct outputs of the feature and structure encoders. The core of our model is the Cross-Diffused Attention (_XDA_) Transformer, which consists of \(L\) stacked layers that simultaneously refine the feature and structure embeddings [31]. In each _XDA_ block, both streams first undergo multi-head self-attention to capture intra-view relationships. For example, the feature branch computes self-attention over \(F^{(l)}\) to obtain an updated representation,  
\[F^{\prime}=LN\Big{(}F^{(l)}+SelfAtt\Big{(}F^{(l)}\Big{)}\Big{)}, \tag{11}\]  
and a similar process is followed for the structure branch [44] with \(S^{(L)}\). Given input embeddings \(\mathbf{F}^{(l)}\in\mathbb{R}^{\mathbf{N}\times\mathbf{d}}\), we first compute each of the \(\mathbf{h}\) attention heads:  
\[Q_{i}=F^{(l)}W_{i}^{Q},K_{i}=F^{(l)}W_{i}^{K},V_{i}=F^{(l)}W_{i}^{V}(i=1, \ldots,h), \tag{12}\]  
where \(W_{i}^{Q},W_{i}^{K},W_{i}^{V}\in\mathbb{R}^{\mathbf{d}\times\mathbf{d}_{h}}\), and \(d_{h}=d/h\). Next, each head's output is  
\[\text{head}_{i}=\text{softmax}\left(\frac{Q_{i}K_{i}^{\top}}{\sqrt{d_{h}}} \right)\,V_{i}. \tag{13}\]  
We then concatenate and reproject all heads:  
\[\text{MultiHead}(Q,K,V)=[\text{head}_{1},\ldots,\text{head}_{\mathbf{h}}]\ W^{ \text{O}},W^{\text{O}}\in\mathbb{R}^{d\times\mathbf{d}} \tag{14}\]  
Finally, the self-attention update in Equation (9) becomes  
\[F^{(l+1)}=\text{LayerNorm}\Big{(}F^{(l)}+\text{MultiHead}\Big{(}F^{(l)},F^{( l)},F^{(l)}\Big{)}\Big{)} \tag{15}\]  
Next, cross-attention is performed between the views (see Algorithm 2). In the feature-to-structure direction, the feature embeddings are first linearly projected to form queries \(Q_{F}\) using a weight matrix \(W_{Q}\), while the structure embeddings are projected to be keys \(K_{S}\) and values \(V_{S}\) using \(W_{K}\) and \(W_{V}\), respectively:  
\[Q_{F}=F^{(l)}W_{Q},\ K_{S}=S^{(l)}W_{K},\ V_{S}=S^{(l)}W_{V} \tag{16}\]  
Figure 1: Schematic overview of proposed network X-GANet.