# X-GANet: An Explainable Graph-Based Framework for Robust Network Intrusion Detection
## 3 Materials and Methods
### Constructing a Graph from the CIC-IDS2017 Dataset
Additionally, exploring transfer learning and adversarial training methods holds promise for improving resilience against emerging and zero-day attacks, thus ensuring that XGANet remains a robust and adaptive solution in the evolving landscape of network security. Conceptualization, M.B. and M.-M.H. ; data preprocessing and feature extraction, M.B. ; investigation and literature review, D.-W.K. ; methodology, M.B. ; deep learning design and simulation, M.B. ; funding acquisition, G.-Y.S. All authors have read and agreed to the published version of the manuscript. This research was supported by the Basic Science Research Program through the National Research Foundation of Korea (NRF) funded by the Ministry of Education (RS-2023-00248132). This work was also supported by the National Research Foundation of Korea (NRF) grant funded by the Korean government (MSIT) (No. 2022R1F1A107337513). Not applicable. The data supporting the findings of this study are available from the corresponding author upon reasonable request. The authors declare no conflicts of interest. ## Appendix A Hyperparameters and Training of the Algorithm

In this Appendix, we list all the model hyperparameters and outline the complete end-to-end training and update flow for X-GANet (see Table 11). Table 11 summarizes each parameter, its notation, default value, and role. Algorithm 11 then walks through one epoch of training, from feature/structure encoding and contrastive alignment to Cross-Diffused Attention refinement and adaptive fusion and the final backward update under Adam. ## Appendix B Illustrative Explanations of Equations Formulated in This Study

Self-Attention (Equation (9)): Here, we describe a token pair--\"high packet rate\" and \"long flow duration\"--showing how multi-head attention lets each token re-weigh its own context based on similarity. When the 'high packet rate' token attends strongly to 'long flow duration,' the updated embedding encodes combined temporal-volume cues. Cross-Attention and Diffusion Mask (Equations (11)-(12)): We explain here how the feature token for \"suspicious port scan\" queries the structure token for \"high node degree\", and how the diffusion mask (derived from adjacency) suppresses spurious cross-attention. Entropy-Based Masking (Equations (16)-(18)): We illustrate computing entropy for each token's attention distribution--showing that a uniformly distributed (high-entropy) token becomes down-weighted, while a sharply peaked (low-entropy) token is retained. Gating Fusion (Equations (25) and (26)): We provide a case where the concatenated branches for a DDoS flow yield a gating value \(g=0.9\), emphasizing the structure branch when flow features are noisy. ## References

* (1) [PERSON]; [PERSON]; [PERSON]; [PERSON] Intrusion detection system: A comprehensive review. _J. Netw. Comput. Appl._**2013**, _36_, 16-24. [CrossRef]
* (2) [PERSON]; [PERSON]; [PERSON]; [PERSON] Anomaly-based network intrusion detection: Techniques, systems and challenges. _Comput. Secur._**2009**, _28_, 18-28. [CrossRef]
* (3) [PERSON]; [PERSON] Outside the closed world: On using machine learning for network intrusion detection. In Proceedings of the 2010 IEEE Symposium on Security and Privacy, Oakland, CA, USA, 16-19 May 2010; pp. 305-316. * (4) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] A systematic review on the application of deep learning in network traffic classification and anomaly detection. _IEEE Access_**2019**, \(7\), 27092-27130. * (5) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Graph Neural Networks: A Review of Methods and Applications. _AI Open_**2020**, \(1\), 57-81. [CrossRef]
* (6) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] A Comprehensive Survey on Graph Neural Networks. _IEEE Trans. Neural Netw. Learn. Syst._**2021**, _32_, 4-24. [CrossRef] [PubMed]
* (7) [PERSON]; [PERSON] Semi-supervised classification with graph convolutional networks.