# X-GANet: An Explainable Graph-Based Framework for Robust Network Intrusion Detection
## 1 Introduction  
The rapid growth of digital networks has led to an unprecedented rise in cyber threats, necessitating more-advanced intrusion detection systems (IDSs) capable of identifying and mitigating malicious activities [1]. Traditional IDS approaches, including signature-based detection and statistical anomaly detection, suffer from fundamental limitations. Signature-based methods rely on predefined attack patterns, making them ineffective against previously unseen threats [2], while anomaly-based approaches often produce high false-positive rates due to their reliance on manually input features and simplistic statistical thresholds [3]. Furthermore, most deep learning-based IDS frameworks operate on tabular data and fail to capture the underlying relationships between network entities, limiting their ability to effectively distinguish between normal and malicious behavior [4]. Recent advances in graph-based machine learning have created new possibilities for intrusion detection by modeling network traffic as a structured graph [5]. In this paradigm, network entities such as IP addresses, ports, and packets are represented as nodes, while their interactions (e.g., communication flows) form edges. Graph-based methods provide an intuitive and powerful way to model complex attack behaviors, capturing both attribute-level information and network topologies [6]. However, the existing graph-based IDS models face significant challenges that hinder their practical deployment. First, many models rely on basic Graph Neural Networks (GNNs) such as Graph Convolutional Networks (GCN) [7] or Graph Isomorphism Networks (GIN) [8], which are limited in their ability to extract both flow-based and structure-based features effectively. This results in suboptimal representations that fail to generalize across diverse network environments. Second, most existing methods employ naive feature fusion strategies, where node attributes and graph structures are combined without ensuring their alignment, leading to inconsistent embeddings and decreased detection accuracy [9]. Third, the anomaly detection mechanisms in many IDS frameworks are based on simple thresholding or machine learning classifiers, which lack robustness when distinguishing between normal variations in traffic and actual attack patterns [10]. Lastly, the black-box nature of deep learning-based IDS models poses a challenge for cybersecurity analysts, as these models often lack explainability, making it difficult to interpret why a given network event was classified as an attack [11]. To address these challenges, we propose X-GANet, Explainable Graph Anomaly Network, a novel graph-based intrusion detection framework that integrates contrastive learning [12], transformer-based embeddings [13], and multi-scale anomaly scoring to enhance detection accuracy and interpretability. The proposed network models network traffic as a graph and extracts a rich set of flow-based and structure-based features, ensuring a comprehensive understanding of network activity. To improve coherence between flow and structure representations, a contrastive learning mechanism is employed, enforcing alignment between different views of network traffic [14]. Additionally, a transformer-based embedding module refines the learned representations by capturing long-range dependencies among network entities, enhancing robustness against evasive attack strategies [15]. This paper makes the following key contributions:  
* We propose X-GANet, a novel graph-based intrusion detection framework that effectively models network traffic as a graph and leverages advanced representation-learning techniques for enhanced anomaly detection. * We reveal that our framework processes network data through two distinct yet complementary branches: a feature branch that extracts raw flow and log attributes using dedicated encoders and a structure branch that generates graph-based embeddings via a GNN informed by the normalized adjacency matrix.