# X-GANet: An Explainable Graph-Based Framework for Robust Network Intrusion Detection
## 2 Related Study  
Intrusion detection systems (IDSs) have long been a cornerstone of network security, enabling the detection and mitigation of cyber threats [16]. Traditional IDS methods are generally categorized into signature-based detection and anomaly-based detection. Signature-based IDSs, such as Snort and Zeek, detect intrusions by matching incoming traffic patterns against known attack signatures [17]. While effective against well-documented threats, these systems fail against zero-day attacks and require frequent updates to maintain their efficacy [18]. On the other hand, anomaly-based IDSs aim to detect deviations from normal network behavior using statistical models or machine learning classifiers [19]. These methods, although capable of identifying novel threats, often suffer from high false-positive rates, as they struggle to differentiate between legitimate traffic variations and actual intrusions [20]. To address these limitations, researchers have focused their attention on deep learning-based IDSs due to their ability to automatically extract patterns from raw network traffic [21]. Convolutional Neural Networks (CNNs) have been employed to detect spatial correlations in network traffic data [22], while Recurrent Neural Networks (RNNs) and Long Short-Term Memory (LSTM) models have been explored for capturing temporal dependencies in traffic sequences [23]. However, these deep learning approaches primarily treat network flows as independent observations, failing to model the relational dependencies between network entities [24]. As a result, they perform poorly in detecting coordinated cyberattacks such as botnets, DDoS, and multi-stage intrusions, where an attack involves multiple interacting network components [25]. Graph-based learning has emerged as a promising approach to overcoming these challenges by representing network traffic as a graph structure, where nodes represent network entities (e.g., IPs, ports, and connections) and edges capture their interactions [26]. Graph Neural Networks (GNNs) have shown significant improvements in cyber threat detection by leveraging both node attributes and structural relationships in network traffic [27]. Several studies have applied Graph Convolutional Networks (GCNs) [7] and Graph Isomorphism Networks (GINs) [8] to intrusion detection, demonstrating improved classification performance. However, these models struggle to effectively differentiate between flow-based attributes and structural relationships, leading to suboptimal feature extraction [28]. Some researchers have introduced Graph Attention Networks (GATs) to enhance IDS performance by prioritizing critical network interactions [29]. GAT4 NID, for example, applies attention mechanisms to weight influential connections, improving feature importance estimation [9]. While attention-based GNNs offer improvements, they fail to explicitly align feature-based and structure-based representations, which can lead to inconsistencies in learning [14]. Additionally, most graph-based IDS models rely on simple anomaly-scoring mechanisms, such as basic classifiers or static thresholds, which often result in false positives and unreliable detection in real-world scenarios [30]. Another important advancement in IDSs is contrastive learning, which has been used in self-supervised learning to improve feature extraction by ensuring that similar instances have consistent embeddings while dissimilar ones remain distinct [14]. Several contrastive learning approaches, such as GraphCL, have been explored in cybersecurity applications, but they have not been fully optimized for network intrusion detection, as they often fail to consider the differences between attribute-driven and structure-driven representations in network traffic graphs [31]. Furthermore, most IDS frameworks lack a robust anomaly scoring mechanism, relying on simplistic classifiers rather than more advanced techniques [32].