# X-GANet: An Explainable Graph-Based Framework for Robust Network Intrusion Detection
## 3 Materials and Methods
### Constructing a Graph from the CIC-IDS2017 Dataset
These results further demonstrate the high detection capability of our approach even on datasets with a different distribution. Overall, the extremely low false-positive and false-negative rates across both datasets verify that XGANet's diffusion-based cross-attention mechanism is highly effective at capturing both local and global traffic patterns, ensuring robust performance in real-world intrusion detection scenarios. Figure 9 illustrates distinct clusters of related features, with TCP-related attributes (shown in red) concentrating on connection properties, while the service flags (SFs), in green, focus on traffic patterns. Normal traffic characteristics (in blue) form their own semantic group, allowing for clear differentiation from attack patterns. The highlighted attack nodes demonstrate how specific attack types associate with particular feature combinations, enabling more accurate detection and classification. This semantic approach to feature representation enhances interpretability while maintaining the rich relational information necessary for effective network intrusion detection systems. Figure 8: Confusion matrices comparing datasets. Figure 9: Key semantic network attack features extracted by the detection module. ### Operational Testbed Evaluation

To assess real-world behavior, we deployed X-GANet alongside three representative IDSs (SnortML [54], ZeekML [55], and Suricata [56]) on a small Linux testbed generating mixed benign/attack traffic. We used a testbed consisting of four Ubuntu 18.04 servers connected over a gigabit switch. Each server ran a traffic-replay tool (Tcpreplay) to inject benign and attack traces drawn from the CIC-IDS2017 pcap files, creating a realistic mixed-traffic environment. X-GANet, SnortML, ZeekML, and Suricata were all installed on identical Ubuntu Virtual Machines (VMs), allowing us to measure each system's end-to-end throughput, latency, CPU, and memory under the same conditions. Table 10 summarizes the key detection and resource metrics, while Figure 10 presents the resulting performance surface via an RBF performance blend of each model's throughput vs. latency. Filled contours represent blended performance \"intensity\" from each model's throughput/latency location. ### Inference Efficiency and Production Scalability

To assess real-time applicability, we measured the average inference latency per flow for both the GPU (NVIDIA GTX 1080 Ti) and CPU (Intel i7-7700K). With a single GPU, X-GANet processed a batch of 1024 flows in 0.55 ms per flow (\(\approx\)1820 flows/s), while for the CPU, it achieved 2.1 ms per flow (\(\approx\)480 flows/s). Table 11 summarizes these results. We also simulated a sliding-window streaming scenario (window size = 5000 flows, stride = 1000) to mimic real network traffic bursts. X-GANet sustained a through \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Model** & **Accuracy (\%)** & **Latency (ms)** & **Throughput (pps)** & **CPU (\%)** & **Memory (GB)** \\ \hline X-GANet & 99.1 & 50 & 1000 & 65 & 4.5 \\ SnortML & 95.0 & 100 & 800 & 55 & 3.0 \\ ZeekML & 96.2 & 90 & 850 & 60 & 3.5 \\ Suricata & 92.0 & 80 & 700 & 50 & 2.5 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Operational metrics for each IDS on our live testbed. Figure 10: Operational performance surface obtained via radial-basis blend. put of \(\approx\)1600 flows/s on a GPU with end-to-end preprocessing, feature extraction, and classification. ### Failure Case Analysis

While X-GANet achieved near-perfect scores on most attack types, we observed a notably lower F1-score for XSS (75.8%), primarily due to the severe class imbalance (with only 500 XSS flows, amounting to 0.55% of the dataset) and the high similarity of XSS payload patterns to benign HTTP traffic. Our confusion-matrix inspection (Figure 8) shows that most misclassified XSS flows were labeled as benign, indicating that the model's reliance on global graph context may underemphasize subtle payload anomalies.