X-GANet: An Explainable Graph-Based Framework for Robust Network Intrusion Detection
Source abstract
Abstract
Modern networks are increasingly targeted by sophisticated cyber threats, making effective intrusion detection a critical challenge. Traditional intrusion detection systems (IDSs) often struggle with capturing the complex relationships within network traffic and suffer from a lack of explainability in their decision-making processes. To address these limitations, we propose X-GANet, Explainable Graph Anomaly Network, a novel graph-based intrusion detection framework that models network traffic as a graph and leverages deep representation learning for precise threat identification. The model extracts both flow-based and structural features, aligns multi-view representations through contrastive learning, and employs a transformer-based embedding module for enhanced feature extraction. An adaptive graph detection fusion mechanism ensures effective graph-level representation and detection techniques for robust attack classification. Experimental results obtained from benchmark intrusion detection datasets demonstrate that X-GANet significantly improves detection performance while maintaining interpretability, making it a promising solution for real-world cybersecurity applications.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Anomaly Detection Techniques and Applications · Internet Traffic Analysis and Secure E-voting
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Computing, Gachon University, Seongnam 13120, Republic of Korea
School of Computer Engineering & Applied Mathematics, Hankyong National University, Pyeongtaek 17738, Republic of Korea
Funding
Ministry of Education · Korean government (MSIT)
References (56)
Show source-provided references
1. Intrusion detection system: A comprehensive review10.1016/j.jnca.2012.09.004 ↗
2. Anomaly-based network intrusion detection: Techniques, systems and challenges10.1016/j.cose.2008.08.003 ↗
3. Sommer, R., and Paxson, V. (2010, January 16–19). Outside the closed world: On using machine learning for network intrusion detection. Proceedings of the 2010 IEEE Symposium on Security and Privacy, Oakland, CA, USA.10.1109/SP.2010.25 ↗
4. A systematic review on the application of deep learning in network traffic classification and anomaly detection
5. Graph Neural Networks: A Review of Methods and Applications10.1016/j.aiopen.2021.01.001 ↗
6. A Comprehensive Survey on Graph Neural Networks10.1109/TNNLS.2020.2978386 ↗
7. Kipf, T.N., and Welling, M. (2017, January 24–26). Semi-supervised classification with graph convolutional networks. Proceedings of the 5th International Conference on Learning Representations (ICLR 2017), Toulon, France.
8. Xu, K., Hu, W., Leskovec, J., and Jegelka, S. (2019, January 6–9). How powerful are graph neural networks?. Proceedings of the 7th International Conference on Learning Representations (ICLR 2019), New Orleans, LA, USA.
9. Feature fusion in deep learning: A review10.1016/j.inffus.2021.02.022 ↗
10. A survey of anomaly detection techniques in financial domain. Future Gener
11. Doshi-Velez, F., and Kim, B. (2017). Towards a rigorous science of interpretable machine learning. arXiv.
12. Chen, T., Kornblith, S., Norouzi, M., and Hinton, G. (2020, January 12–18). A Simple Framework for Contrastive Learning of Visual Representations. Proceedings of the 37th International Conference on Machine Learning (ICML 2020), Vienna, Austria.
13. Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, Ł., and Polosukhin, I. (2017, January 4–9). Attention is all you need. Proceedings of the Advances in Neural Information Processing Systems (NIPS 2017), Long Beach, CA, USA.
14. You, Y., Chen, T., Sui, Y., Chen, T., Wang, Z., and Shen, Y. (IEEE Trans. Knowl. Data Eng., 2022). Graph Contrastive Learning: Methods and Applications, IEEE Trans. Knowl. Data Eng., early access.
15. Devlin, J., Chang, M.W., Lee, K., and Toutanova, K. (2019, January 2–7). BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. Proceedings of the NAACL-HLT, Minneapolis, MN, USA.
16. Guide to intrusion detection and prevention systems (IDPS)
17. Roesch, M. (1999, January 7–12). Snort—Lightweight intrusion detection for networks. Proceedings of the 13th USENIX Conference on System Administration (LISA 1999), Seattle, WA, USA.
18. Bro: A system for detecting network intruders in real-time10.1016/S1389-1286(99)00112-7 ↗
19. Anomaly detection: A survey10.1145/1541880.1541882 ↗
20. Lippmann, R., Fried, D.J., Graf, I., Haines, J.W., Kendall, K.R., McClung, D., and Weber, D. (2000, January 24–26). Evaluating intrusion detection systems: The 1998 DARPA off-line intrusion detection evaluation. Proceedings of the DARPA Information Survivability Conference and Exposition (DISCEX 2000), Hilton Head, SC, USA.
21. Deep learning10.1038/nature14539 ↗
22. Deep packet: A novel approach for encrypted traffic classification using deep learning10.1007/s00500-019-04030-2 ↗
23. Kim, Y. (2014, January 25–29). Convolutional Neural Networks for Sentence Classification. Proceedings of the EMNLP 2014, Doha, Qatar.10.3115/v1/D14-1181 ↗
24. An evaluation of deep learning for identifying malicious network traffic
25. Kitsune: An ensemble of autoencoders for online network intrusion detection
26. Zhang, C., Song, D., Huang, C., Swami, A., and Qi, Y. (2019, January 4–8). Heterogeneous Graph Neural Network. Proceedings of the KDD 2019, Anchorage, AK, USA.
27. Graph Neural Networks and Their Applications
28. Gao, H., and Ji, S. (2019, January 9–15). Graph U-Nets. Proceedings of the ICML 2019, Long Beach, CA, USA.
29. Velickovic, P., Cucurull, G., Casanova, A., Romero, A., Lio, P., and Bengio, Y. (May, January 30). Graph Attention Networks. Proceedings of the ICLR 2018, Vancouver, BC, Canada.
30. Zhang, M., Cui, Z., Neumann, M., and Chen, Y. (2018, January 2–7). An End-to-End Deep Learning Architecture for Graph Classification. Proceedings of the AAAI 2018, New Orleans, LA, USA.10.1609/aaai.v32i1.11782 ↗
31. Hassani, K., and Khasahmadi, A.H. (2020, January 12–18). Contrastive Multi-View Representation Learning on Graphs. Proceedings of the ICML 2020, Vienna, Austria.
32. Anomaly Detection on Attributed Networks via Contrastive Self-Supervised Learning
33. Anomaly Detection in Dynamic Networks: A Survey10.1002/wics.1347 ↗
34. Suspicious Behavior Detection: Current Trends and Future Directions
35. Hierarchical Graph Networks for Explainable Anomaly Detection
36. Network Intrusion Detection with Graph Representation Learning
37. Similarity-based Anomaly Detection for Network Security
38. Hierarchical Temporal Graph Neural Networks for Cyber Intrusion Detection
39. Grover, A., and Leskovec, J. (2016, January 13–17). node2vec: Scalable Feature Learning for Networks. Proceedings of the KDD 2016, San Francisco, CA, USA.10.1145/2939672.2939754 ↗
40. Kipf, T.N., and Welling, M. (2016, January 5–10). Variational Graph Auto-Encoders. Proceedings of the NeurIPS 2016, Barcelona, Spain.
41. A Graph-based Approach for Anomaly Detection in Network Traffic
42. Temporal Graph Learning for Intrusion Detection
43. A Robust GNN-based Framework for Anomaly Detection in Dynamic Graphs
44. Cross-Diffused Graph Attention Networks for Network Anomaly Detection
45. An Unsupervised Anomaly Detection Framework for High-Dimensional Network Traffic
46. Sharafaldin, I., Lashkari, A.H., and Ghorbani, A.A. (2018, January 22–24). Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. Proceedings of the 4th International Conference on Information Systems Security and Privacy (ICISSP 2018), Funchal, Portugal.10.5220/0006639801080116 ↗
47. Deep Learning for Cyber Intrusion Detection: Approaches, Datasets, and Challenges
48. He, K., Zhang, X., Ren, S., and Sun, J. (2016, January 27–30). Deep Residual Learning for Image Recognition. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR 2016), Las Vegas, NV, USA.10.1109/CVPR.2016.90 ↗
49. Goodfellow, I., Bengio, Y., and Courville, A. (2016). Deep Learning, MIT Press.
50. A Hybrid Deep Learning Framework for Anomaly Detection in Cyber-Physical Systems
51. CNN-LSTM-Based Anomaly Detection for Cybersecurity Systems
52. GAT-based Network Intrusion Detection with Hierarchical Attention Mechanism
53. A Fast Learning Algorithm for Deep Belief Nets10.1162/neco.2006.18.7.1527 ↗
54. Panda, M., and Nadkarni, A. (2020, January 15–17). SnortML: Enhancing Signature-Based Intrusion Detection via Machine Learning. Proceedings of the 2020 International Conference on Cybersecurity (ICC), Seoul, Republic of Korea.
55. ZeekML: A Machine Learning Extension for Zeek-Based Network Traffic Analysis
56. Open Information Security Foundation (2025, April 20). Suricata: Open Source IDS/IPS/NSM Engine. Available online: https://suricata.io/.