# X-GANet: An Explainable Graph-Based Framework for Robust Network Intrusion Detection
## 3 Materials and Methods
### Constructing a Graph from the CIC-IDS2017 Dataset
\(\text{d}_{\text{h}}\leftarrow\text{d}/\text{H}\)
2. Initialize list \(\text{O}\leftarrow\llbracket\rrbracket\)
3. for h \(\leftarrow\) 1 to H do \(\triangleright\) Multi-head linear projections
4. \(\text{Q}^{\text{(h)}}\leftarrow\text{F}\cdot\text{W}_{\text{Q}}{}^{\text{(h)}}\) \(\in\mathbb{R}^{\text{N}\times\text{d}_{\text{h}}}\)
5. \(\text{K}^{\text{(h)}}\leftarrow\text{S}\cdot\text{W}_{\text{K}}{}^{\text{(h)}}\) \(\in\mathbb{R}^{\text{N}\times\text{d}_{\text{h}}}\)
6. \(\text{V}^{\text{(h)}}\leftarrow\text{S}\cdot\text{W}_{\text{V}}{}^{\text{(h)}}\) \(\in\mathbb{R}^{\text{N}\times\text{d}_{\text{h}}}\)
7. \(\text{A}_{\text{raw}}{}^{\text{(h)}}\leftarrow\text{Q}^{\text{(h)}}\cdot(\text{ K}^{\text{(h)}})^{\text{T}}/\text{v}\text{d}_{\text{h}}\triangleright\) Compute raw attention scores
8. \(\text{A}^{\text{(h)}}\leftarrow\text{softmax}(\text{A}_{\text{raw}}{}^{\text{(h)}})\)
9. \(\text{D}^{\text{(h)}}\leftarrow\text{DIFUSION(F,S)}\)\(\triangleright\) Generate diffusion mask based on intra-view similarities
10. \(\text{A}_{\text{mod}}{}^{\text{(h)}}\leftarrow\text{A}^{\text{(h)}}\odot\text {D}^{\text{(h)}}\)\(\triangleright\) Modulate attention scores
11. \(\text{O}^{\text{(h)}}\leftarrow\text{A}_{\text{mod}}{}^{\text{(h)}}\cdot\text{V} ^{\text{(h)}}\)\(\triangleright\) Compute head output
12. Append O(\({}^{\text{(h)}}\) to \(\mathbf{O}\)
13. endfor
14. \(\text{O}\leftarrow\text{Concat(O}^{\text{(1)}}\), \(\text{O}^{\text{(2)}}\), \(\dots\), \(\text{O}^{\text{(H)}}\))
15. \(\text{XDA}_{\text{Out}}\leftarrow\text{O}\cdot\text{W}_{\text{O}}\)
16. \(\text{F}_{\text{out}}\leftarrow\text{LayerNorm(F}+\text{XDA}_{\text{Out}}\))
17. return Fout
```
**Algorithm 2**Multi-Head Cross-Diffused Attention (XDA) Block
```
0: Feature embeddings \(\text{F}\in\mathbb{R}^{\text{N}\times\text{d}}\), Structure embeddings \(\text{S}\in\mathbb{R}^{\text{N}\times\text{d}}\)
0: Diffusion mask \(\text{D}\in\mathbb{R}^{\text{N}\times\text{N}}\)
1. for i \(\leftarrow\) 1 to N do
2. for j \(\leftarrow\) 1 to N do
3. \(\text{s}_{\text{F}}\leftarrow\text{sim}(\text{F}_{\text{i}}\), \(\text{F}_{\text{j}})\)\(\triangleright\

#### 3.2.1 Cross-Diffused Attention (XDA) Block

In our approach, the XDA block (see Figure 2) fuses feature and structure representations by integrating diffusion-based modulation into the cross-attention mechanism. Given feature embeddings \(F\in\mathbb{R}^{\text{N}}\times\text{d}\) and structure embeddings \(S\in\mathbb{R}^{\text{N}}\times\text{d}\), we first compute their linear projections to obtain queries, keys, and values as follows:

\[A_{ij}=e_{ij} \tag{7}\]9

where \(W_{Q}\), \(W_{K}\), and \(W_{V}\) are learnable weight matrices. This is unlike standard attention, which computes weights as \(A\) (Equation (11)). We incorporate a diffusion function \(\Delta(F,S)\) that accounts for intra-modal connectivity. The modulated attention is then computed as follows:

\[D_{ii}=\sum_{j}A_{ij} \tag{8}\]0

The formulation for the diffusion term is,

\[D_{ii}=\sum_{j}A_{ij} \tag{8}\]1

where cosine(\(\cdot\),\(\cdot\)) is the cosine similarity between vectors. The output of the XDA block is computed,

\[D_{ii}=\sum_{j}A_{ij} \tag{8}\]2

and integrated into the original feature representation via a residual connection and layer normalization:

\[D_{ii}=\sum_{j}A_{ij} \tag{8}\]3

\[D_{ii}=\sum_{j}A_{ij} \tag{8}\]4 Overview of XDA transformer module. This mechanism ensures that the attention weights are dynamically adjusted not only through cross-modal interactions but also the inherent diffusion characteristics of each view. The embeddings are iteratively refined by incorporating a Learnable Co-occurrence Matrix (LCM), which adaptively captures the dynamic relationships between features and structures.