# X-GANet: An Explainable Graph-Based Framework for Robust Network Intrusion Detection
## 3 Materials and Methods
### Constructing a Graph from the CIC-IDS2017 Dataset
By combining these dual perspectives in a unified transformer architecture with residual connections and adaptive fusion, XGANet achieves robust performance in distinguishing malicious activity from benign traffic [45]. ### Dataset Description

In this research, we utilized the CIC-IDS2017 dataset, a comprehensive benchmark widely used for evaluating intrusion detection systems (see Figure 3) [46]. This dataset was generated by the Canadian Institute for Cybersecurity (CIC) and simulates real-world network traffic with a variety of contemporary attacks executed within a controlled environment. The dataset includes diverse attack types, such as DoS, DDoS, Port Scan, Botnets, Brute Force, and infiltration attacks, along with benign traffic, thereby providing a rich set of scenarios for evaluating intrusion detection methods [47]. The traffic was recorded over five days, with each day featuring different combinations of attack scenarios and normal activities, resulting in over 2.8 million records across approximately 80 distinct features [48]. Table 1 provides an overview of the dataset's attributes, including network flow properties such as flow duration, total bytes, total packets, protocol types, inter-arrival time, and source/destination information [16]. \[D_{ii}=\sum_{j}A_{ij} \tag{8}\]9 Attack class distribution for the CIC-IDS2017 dataset. Table 2 below provides details on the post-preprocessing of the dataset, highlighting critical adjustments made to effectively support the graph-based intrusion detection task. To facilitate feature extraction, we divided our approach into two distinct views: feature branch and structure branch. Tables 3 and 4 illustrate the specific features extracted for each view. Table 5 illustrates the detailed distribution of the dataset. \begin{table}
\begin{tabular}{l l l} \hline \hline
**Attribute** & **Description** & **Type** \\ \hline Flow Duration & Total duration of network flow & Continuous \\ Total Bytes & Quantity of bytes transmitted in the flow & Continuous \\ Total Packets & Number of packets in the flow & Continuous \\ Source/Destination Ports & Port numbers of the flow endpoints & Discrete \\ Protocol & Network protocol (TCP/UDP/ICMP) & Categorical \\ Packet Rate & Packets per second & Continuous \\ Avg Packet Size & Average size of packets & Continuous \\ Avg. Inter-Arrival Time & Average interval between packets & Continuous \\ Timestamp & Time of flow initiation & Temporal \\ Source/Destination IP & IP addresses involved in the flow & Categorical \\ Label & Flow label (benign or specific attack type) & Categorical \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Overview of the CIC-IDS2017 dataset. \begin{table}
\begin{tabular}{l l} \hline \hline
**Features Branch Attributes** & **Description** \\ \hline Normalized Flow Duration & Duration scaled between 0 and 1 \\ Normalized Total Bytes & Byte count scaled between 0 and 1 \\ Normalized Total Packets & Number of packets scaled between 0 and 1 \\ Encoded Protocol Type & One-hot-encoded (TCP, UDP, ICMP) \\ Flow Rate & Packets per second \\ Average Packet Size & Average size of packets in the flow \\ Normalized Avg. Inter-Arrival Time & Time intervals scaled between 0 and 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Extracted features for the feature branch. \begin{table}
\begin{tabular}{l l} \hline \hline
**Attribute** & **Description** \\ \hline Node Degree & Degree of the node within the graph \\ Node Centrality & Importance of a node based on connectivity \\ Source/Destination IP Connectivity & Binary indication of IP-based connectivity \\ Temporal Proximity & Indicator of flows within a specific time window \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Extracted features for the structure branch.