# X-GANet: An Explainable Graph-Based Framework for Robust Network Intrusion Detection
## 3 Materials and Methods
### Constructing a Graph from the CIC-IDS2017 Dataset
These results confirm that our approach consistently delivered near-perfect performance, with minimal variation across different datasets, thereby establishing the robustness and wide applicability of XGANet. ### Comparison with State-of-the-Art Methods with Respect to CIC-IDS2017

In order to highlight the impact of our novel diffusion-based attention mechanism, we compared XGANet with several SOTA methods frequently employed in intrusion detection research [50]. In addition to conventional models such as CNN-based models, standard GCNs, and Transformers with basic cross-attention, we also included more advanced architectures such as CNN-LSTM, Graph Attention (GAT) networks, and Deep Belief Networks (DBNs) [51]. Table 9 details the performance metrics along with the training time per epoch for each method with respect to the CIC-IDS2017 dataset. Our proposed model achieved an accuracy of 99.8%, with superior precision, recall, and F1 scores, while also maintaining a competitive time complexity of 0.50 s per epoch [52]. These results clearly indicate that our model outperformed all the other approaches with which it was compared. The table demonstrates that XGANet not only achieves significantly higher accuracy and F1 scores compared to traditional models but also offers lower or comparable training times per epoch. This balance between performance and efficiency is crucial for real-time intrusion detection in dynamic network environments [53]. ### Comparison with SOTA Architectures Regarding Time Complexity

A critical aspect of deploying an intrusion detection system is its ability to scale and respond in real-time. To further evaluate our model, we compared the time complexity of XGANet with other SOTA architectures. As shown in Table 9, although methods such as E-GraphSAGE and GAT achieve high accuracy, they require longer per-epoch training times (0.65-0.68 s) due to their more complex graph-processing mechanisms. In contrast, XGANET not only has superior accuracy but also requires only 0.50 s per epoch. This efficient performance is achieved through our streamlined diffusion-based attention mechanism, which effectively fuses multi-view data without incurring excessive computational overhead. To further illustrate the effectiveness of our proposed XGANet model, we present the confusion matrices (see Figure 8) for two benchmark datasets--CIC-IDS2017 and UNSW-NB15. The matrices below show the distribution of correct and incorrect classifications between the two classes: attack and benign. For the CIC-IDS2017 test set, out of 84,831 flows (with approximately 16,966 attack flows and 67,865 benign flows), our model correctly classified 16,886 attack flows and 67,775 benign flows, resulting in only 170 misclassified flows (a 0.20% error rate). This near-perfect performance confirms our model's robustness in distinguishing between malicious and benign network traffic. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Method** & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **F1 Score (\%)** & **AUC** & **Time Complexity (\%/Epoch)** \\ \hline CNN-Based Approach & 95 & 94.2 & 94.8 & 94.5 & 0.96 & 0.45 \\ \hline Conventional GCN & 96.5 & 96 & 96.3 & 96.2 & 0.97 & 0.55 \\ \hline Standard Transformer (Cross-Attention) & 97 & 96.5 & 96.8 & 96.7 & 0.97 & 0.6 \\ \hline CNN-LSTM & 97.5 & 97.2 & 97.4 & 97.3 & 0.975 & 0.7 \\ \hline Graph Attention Network (GAT) & 98 & 97.8 & 98 & 97.9 & 0.98 & 0.68 \\ \hline E-GraphSAGE & 98.2 & 98 & 98.1 & 98 & 0.98 & 0.65 \\ \hline Deep Belief Network (DBN) & 96.8 & 96.4 & 96.6 & 96.5 & 0.965 & 0.6 \\ \hline
**Proposed** & 99.8 & 99.5 & 99.8 & 99.7 & 0.99 & 0.5 \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Performance comparison with respect to CIC-IDS2017. For the UNSW-NB15 test set (consisting of 50,000 flows, with approximately 19,390 attack flows and 30,610 benign flows), our model achieved an overall accuracy of 98.9%. It correctly predicted 19,140 attack flows and 30,310 benign flows, with a total of 550 misclassified flows (1.1% error rate).