# X-GANet: An Explainable Graph-Based Framework for Robust Network Intrusion Detection
## 3 Materials and Methods  
### Constructing a Graph from the CIC-IDS2017 Dataset  
Intrusion detection requires analyzing relationships between network flows to distinguish between normal and malicious activities effectively. Unlike conventional machine learning models that treat network flows as independent samples, a graph-based representation captures both flow-specific attributes and structural relationships among flows (see Algorithm 1) [33]. This structured representation enables Graph Neural Networks (GNNs) to learn meaningful dependencies that characterize attack patterns more effectively [34]. To achieve this, we transformed the CIC-IDS2017 dataset into a graph \(\big{(}\mathcal{G}=\big{(}\mathcal{V},\mathcal{E},X,\hat{A}\big{)}\big{)}\), where the following variables are used:  
* \(V=\{v_{i}\}\) is the set of nodes, each corresponding to a network flow \(\mathrm{f_{i}}\). * \(E=\big{\{}\big{(}v_{i},v_{j}\big{)}\mid\hat{A}_{ij}=1\big{\}}\) is the undirected edge set defined by the normalized adjacency. * \(\hat{A}=D^{-\frac{1}{2}}(A+I)D^{-\frac{1}{2}}\) is the symmetrically normalized adjacency matrix, constructed by combining IP-based (Equation (3)) and temporal (Equation (4)) connectivity. * \(X=[x_{1};\,\ldots;\,x_{n}]\in\mathbb{R}^{n\times d}\) is the node-feature matrix, whose ith row \(\mathrm{x_{i}}\) is the d-dimensional flow feature vector defined in Equation (1). As nodes represent network flows, edges define connectivity based on host and temporal relationships, and the adjacency matrix captures the interaction structure within the network [35]. The constructed graph serves as the input for the subsequent contrastive representation-learning and anomaly-scoring modules, ensuring that both localized flow behaviors and global network attack patterns are considered in the detection process [36]. Node-Edge Representation and Feature Extraction  
Each network flow \(f_{i}\) in the CIC-IDS2017 dataset is represented as a node \(v_{i}\in\mathcal{V}\), where node features \(x_{i}\) encapsulate both packet-level characteristics and session-level attributes [37]. To comprehensively describe network traffic behavior, we extract key statistical features from each flow, forming a \(d\)-dimensional feature vector:  
\[x_{i}=[d_{i},b_{i},p_{i},sp_{i},dp_{i},proto_{i},f\_rate_{i},avg\_pkt\_size_{i}, iat_{i}] \tag{1}\]  
The variables above are explained below:  
\(d_{i}=\) flow duration (total time of flow activity). \(b_{i}=\) total bytes transmitted in the flow. \(p_{i}=\) total packets exchanged. \(sp_{i}\), \(dp_{i}=\) source and destination port numbers. \(proto_{i}=\) protocol type, one-hot encoded (TCP, UDP, ICMP). \(f\_{l}\_{rate_{i}}=\) flow rate, computed as packets per second. \(avg\_pkt\_size_{i}=\) average packet size within the flow. \(iat_{i}=\) average inter-arrival time of the packets [38]. Since GNNs are highly sensitive to feature magnitudes, we normalize continuous features using min-max scaling, ensuring uniformity [39]:  
\[x^{\prime}=\frac{x-\min(x)}{\max(x)-\min(x)} \tag{2}\]  
where \(x^{\prime}\) is the scaled feature value. This step prevents numerical instability and improves the generalization of the model across different network conditions [40]. Edges \(\mathrm{e_{ij}}\in\mathcal{E}\) are constructed based on relationships between flows, defining how flows are linked within the network. We establish connectivity using two primary criteria. Flows that originate from or are destined to go to the same IP address are likely to be associated with the same host or attack pattern. We define an edge between two flows \(f_{i}\) and \(f_{j}\) if they share a common source or destination IP, as shown below. \[e_{ij}= \begin{cases}1,&\text{if }IP_{\text{src},i}=IP_{\text{src},j}\text{ or }IP_{\text{dst},i}=IP_{\text{dst},j},\\ 0,&\text{otherwise}.\end{cases}  \tag{3}\]  
This connectivity structure allows the model to capture coordinated attack behaviors, such as botnet infections or port-scanning attacks, where multiple flows originate from the same compromised source [41].