# X-GANet: An Explainable Graph-Based Framework for Robust Network Intrusion Detection
## 3 Materials and Methods
### Constructing a Graph from the CIC-IDS2017 Dataset
Formally, the embedding at iteration \(t+1\) is updated as follows:

\[D_{ii}=\sum_{j}A_{ij} \tag{8}\]5

where \(\mathrm{E}^{\mathrm{t}}\) represents embeddings at iteration \(t\), \(\varphi(\cdot)\) denotes an element-wise non-linear activation function, \(LCM\) is the Learnable Co-occurrence Matrix updated during training, \(\sigma(\cdot)\) denotes a non-linear activation function, and \(\alpha\) is a learnable weighting parameter that balances previous embeddings and LCM-driven updates. Intuitively, the Learnable Co-occurrence Matrix (LCM) can be viewed as a dynamic memory of feature-structure pairings that frequently co-activate during training. Each entry \(\mathrm{LCM}_{ij}\) represents the learned strength of the association between the \(i\)th feature token and the \(j\)th structural token. During iterative refinement (Equation (25)), strongly co-occurring pairs boost each other's representations. The end-to-end update procedure of the architecture is explained in Appendix A (Algorithm A1). #### 3.2.2 Fusion Block and Classifier

Following the series of XDA blocks, the network produces two refined embedding streams--one from the feature branch and one from the structure branch, denoted as \(\mathrm{F}^{\mathrm{L}}\) and \(\mathrm{S}^{\mathrm{L}}\), respectively. To effectively combine these complementary representations, we employ an adaptive fusion block based on a gating mechanism. Specifically, we compute a gating vector \(g\):

\[D_{ii}=\sum_{j}A_{ij} \tag{8}\]6

where \(\sigma(\cdot)\) is the sigmoid function, \(\oplus\) denotes concatenation, and \(W_{g}\) and \(b_{g}\) are learnable parameters--i.e., \(W_{g}\in\mathbb{R}^{d\times 2d}\) and \(b_{g}\in\mathbb{R}^{d}\) are the trainable weight matrix and bias vector--updated via gradient descent. They control the gating function \(\sigma(\cdot)\), determining how much each of the two embedding streams contributes to the final fused representation. The fused representation \(Z\) is then derived as follows:

\[D_{ii}=\sum_{j}A_{ij} \tag{8}\]7

where \(\odot\) represents elementwise multiplication. This adaptive fusion enables the model to dynamically balance the contribution of each view based on the learned gating weights. Finally, the unified representation \(Z\) is processed by a two-layer feed-forward network with ReLU activation, culminating in a softmax classifier:

\[D_{ii}=\sum_{j}A_{ij} \tag{8}\]8

The gating mechanism acts as a soft, learnable'switch' that balances the contributions of the feature and structure branches. The gating vector \(g\) (Equation (26)) is computed by passing the concatenated branch embeddings through a sigmoid layer. Values of \(g\) close to 1 emphasize flow-based information, while values near 0 emphasize structural context. This allows the network to adaptively weight each view according to which one provides more reliable signals for a given flow. This final classification stage robustly integrates the information captured from both the feature and structure domains, facilitating accurate discrimination between benign and malicious network flows. The overall explanation of the definitions mentioned above are explained in Appendix B. ## 4 Experimental Results

In this study, we propose a novel intrusion detection network that leverages the unique capabilities of Diffusion Attention to fuse heterogeneous representations [38]. XGANet integrates two complementary views of network traffic: a feature branch derived from raw tabular/log data and a structure branch obtained via a graph constructed from network flows. The core innovation lies in the XDA module, which augments the standard cross-attention mechanism by incorporating diffusion information derived from the intrinsic connectivity of the graph [44]. This mechanism allows the network to emphasize critical relationships, enhancing its ability to detect subtle and coordinated attack patterns.