# X-GANet: An Explainable Graph-Based Framework for Robust Network Intrusion Detection
## 3 Materials and Methods
### Constructing a Graph from the CIC-IDS2017 Dataset
Therefore, our method represents an improvement but still lags in terms of its performance on other classes. ## 6 Limitations

Despite its exceptional performance, our proposed XGANet with a Cross-Diffused Attention module has several limitations that warrant further investigation. First, this model's efficacy is highly dependent on the quality of graph construction and feature selection. Real-world network traffic can also be noisy or rapidly change, which can degrade performance if the underlying relationships are not accurately captured. Additionally, the diffusion-based attention mechanism enhances our model's ability to integrate local and global patterns. However, it also introduces extra computational overhead that may limit the system's scalability and real-time applicability in high-speed environments. The model also relies on several hyperparameters (such as the number of transformer layers, attention heads, and diffusion scaling factors). These hyperparameters require careful tuning and may affect the model's generalizability, especially when faced with novel or zero-day attack scenarios. Moreover, our evaluation was conducted mainly on benchmark datasets, which may not fully represent the complexity of real-world network traffic. This limitation raises concerns about the model's performance under diverse operational conditions. We also observed that X-GANet underperformed on the XSS class (Table 6) due to its <1% representation and our reliance on header-level and graph-topology features. In future experiments, we will integrate lightweight application-layer script indicators and apply targeted oversampling (e.g., SMOTE) to improve XSS detection. Finally, the interpretability of the decision-making process is limited, potentially hindering trust and the ability of security analysts to understand and validate the alerts generated by the system. Additionally, while X-GANet achieves high accuracy, its inference cost--especially on CPU--may pose challenges for ultra-high-speed networks. Employing quantization or pruning techniques and leveraging hardware accelerators (e.g., FPGAs and NPUs) can mitigate this overhead in production settings. ## 7 Conclusions and Future Direction

In conclusion, our study introduces XGANet, a novel network intrusion detection framework that integrates heterogeneous data representations through a Cross-Diffused Attention (XDA) mechanism. This model demonstrated superior performance on benchmark datasets--CIC-IDS2017, UNSW-NB15, and CIC-IDS2018--with exceptional accuracy, \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Hardware** & **Batch Size** & **Latency per Flow (ms)** & **Throughput (Flows/s)** \\ \hline NVIDIA GTX 1080 Ti & 1024 & 0.55 & 1820 \\ Intel i7-7700K CPU & 1024 & 2.10 & 480 \\ Streaming (GPU) & 5000 & – & 1600 \\ \hline \hline \end{tabular}
\end{table} 
Table 11: Inference performance. precision, recall, and F1 scores, thereby establishing its efficacy in detecting both isolated and coordinated attack patterns. The empirical results underscore that our diffusion-based attention strategy effectively captures both local and global structural patterns inherent in network traffic, while the incorporation of residual connections further enhances learning stability and performance consistency. Nonetheless, our approach is contingent upon high-quality data preprocessing and robust graph construction, and the additional computational overhead introduced by the diffusion mechanism may pose challenges in real-time deployment scenarios. Future research could aim to optimize the computational efficiency of the XDA module to facilitate its scalability in dynamic, large-scale network environments. Furthermore, integrating explainable AI techniques could enhance the interpretability of the model's decision-making process, thereby increasing its practical applicability and trust among cybersecurity professionals. Expanding the experimental evaluation to include more diverse and contemporary datasets will be critical in validating the generalizability of our approach.