# X-GANet: An Explainable Graph-Based Framework for Robust Network Intrusion Detection
## 3 Materials and Methods
### Constructing a Graph from the CIC-IDS2017 Dataset
The evaluation metrics used include accuracy, precision, recall, F1 score, and area under the receiver operating characteristic curve (AUC), which collectively provide a \begin{table}
\begin{tabular}{l l l} \hline
**Label** & **Number of Data** & **Ratio (\%)** \\ \hline DoS Slowhttptest & 2500 & 2.75 \\ Port Scan & 7500 & 2.75 \\ Botnet & 15,800 & 7.98 \\ Web Brute Force & 1200 & 1.33 \\ SSH Patator & 1000 & 1.11 \\ SQL Injection & 50 & 0.06 \\ XSS & 500 & 0.55 \\ Infiltration & 40 & 0.04 \\ Heartbleed & 20 & 0.02 \\ Total & 90,600 & 100\% \\ \hline \end{tabular}
\end{table} 
Table 5: _Cont._comprehensive assessment of a model's performance in detecting malicious activity [11]. The evaluation was carried out on the test set after the training process was complete. \[Accuracy=\frac{TP+TN}{TP+TN+FP+FN} \tag{37}\]

where TP, TN, FP, and FN denote true positive, true negative, false positive, and false negative, respectively. Precision is calculated as follows:

\[Precision=\frac{TP}{TP+FP} \tag{38}\]

Recall is calculated as follows:

\[Recall=\frac{TP}{TP+FN} \tag{39}\]

The F1 score is calculated as follows:

\[F1-score=2\times\frac{precision\times recall}{precision+recall} \tag{40}\]

Overall, this experimental setup is designed to allow a rigorous evaluation of the effectiveness of XGANet and its XDA module in fusing multi-view data for intrusion detection, ensuring that both localized and global patterns in network traffic are effectively captured. ### Performance Evaluation

This Section presents the experimental results and a quantitative evaluation of our proposed XDA approach with respect to the CIC-IDS2017 dataset. We begin by detailing the per-class classification metrics; this is followed by an N-round evaluation demonstrating robustness over multiple runs. Finally, we compare our method against conventional approaches to underscore its superiority in both accuracy and loss. Table 6 shows the classification accuracy, precision, recall, and F1 score for each class in the CIC-IDS2017 dataset. We include the number of flows (Count) in each category to emphasize the class distribution. The results demonstrate that our method attains near-perfect performance across a range of attacks as well as for benign traffic. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Class** & **Count** & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **F1 Score (\%)** \\ \hline Benign & 100,000 & 99.9 & 99.9 & 99.9 & 99.9 \\ \hline Botnet & 15,000 & 98.7 & 98.5 & 98.9 & 98.7 \\ \hline DoS & 12,000 & 99.4 & 99.3 & 99.5 & 99.4 \\ \hline DDoS & 8000 & 99.8 & 99.7 & 99.8 & 99.8 \\ \hline Infiltration & 5000 & 97.8 & 97.6 & 97.5 & 97.6 \\ \hline Web Attack & 10,000 & 99.2 & 99.1 & 99.3 & 99.2 \\ \hline PortScan & 7500 & 100 & 100 & 100 & 100 \\ \hline BruteForce & 14,000 & 98.9 & 98.8 & 98.9 & 98.9 \\ \hline Heartbleed & 20,000 & 100 & 99.6 & 99.4 & 99.8 \\ \hline Attack\_XSS & 2560 & 74.8 & 78.9 & 77.5 & 75.8 \\ \hline Attack\_Sql Injection & 13,000 & 90.6 & 87.6 & 90.5 & 89.2 \\ \hline SSH-Patator & 8750 & 94.2 & 96.4 & 95.6 & 95.7 \\ \hline Attack\_Brute Force & 3200 & 90.2 & 89.6 & 88.1 & 92.4 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Classification metrics obtained using CIC-IDS2017. Overall, our model achieved an accuracy of 99.8% across all classes, with most attack types exceeding 98% in terms of F1 score. These figures highlight the model's ability to handle both frequent and less frequent attack scenarios effectively, demonstrating consistent robustness. To assess the stability of our model, we conducted N-round evaluations, where the model was trained and tested multiple times under identical settings. Table 7 summarizes the mean, standard deviation, minimum, and maximum values for accuracy, precision, recall, and F1 score [14] across these rounds. The minimal standard deviation indicates a highly stable performance from run to run. These results confirm that the proposed XDA consistently delivered high accuracy (near 99.8%) and near-perfect precision/recall across multiple runs.