XGA-E: an explainability-enhanced graph neural network for network traffic anomaly detection

Abstract Graph neural network (GNN) have demonstrated excellent performance in network traffic anomaly detection research. However, existing GNN-based approaches often lack interpretability, and their detection performance remains to be improved. To address these challenges, we propose XGA-E, an interpretability-enhanced GNN model for network traffic anomaly detection that leverages graph neural networks, explainable artificial intelligence (XAI) techniques, and gradient boosting-based anomaly detection classifiers. We developed the core architecture of XGA-E and established protocols for preprocessing network traffic data, based on which graph-structured representations were constructed from traffic features. To enable effective and interpretable anomaly detection, we further designed model training procedures alongside an interpretative analysis framework. We implemented XGA-E and evaluated its performance through simulation experiments on a public dataset. The results demonstrate that XGA-E outperforms existing models reported in the literature and exhibits strong performance in network traffic anomaly detection. Moreover, the XGA-E interpreter successfully identifies edges that are critical to the model’s decision-making process.