Graph Convolution Neural Network and Deep Q-Network Optimization-Based Intrusion Detection with Explainability Analysis

As networks expand in size and complexity, coupled with an exponential increase in intrusions on network and IoT systems, this leads to traditional models failing to capture increasingly intricate correlations among network components accurately. Graph Convolution Networks (GCNs) have recently acquired prominence for their capacity to represent nodes, edges, or entire graphs by aggregating information from adjacent nodes. However, the correlations between nodes and their neighbours, as well as related edges, differ. Assigning higher weights to nodes and edges with high similarity improves model accuracy and expressiveness. In this paper, we propose the GCN-DQN model, which integrates GCN with a multi-head attention mechanism and DQN (Deep Q Network) to adaptively adjust attention weights optimizing its performance in intrusion detection tasks. After extensive experiments using the UNSW NB15 and CIC-IDS2017 dataset, the proposed GCN-DQN outperformed the baseline model in classification accuracy. We also applied LIME and SHAP techniques to provide explainability to our proposed intrusion detection model.