{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,9]],"date-time":"2026-01-09T12:08:32Z","timestamp":1767960512850,"version":"3.49.0"},"reference-count":49,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2026,1,9]],"date-time":"2026-01-09T00:00:00Z","timestamp":1767916800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,1,9]],"date-time":"2026-01-09T00:00:00Z","timestamp":1767916800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"Sichuan Science and Technology Program","award":["2025ZNSFSC0503"],"award-info":[{"award-number":["2025ZNSFSC0503"]}]},{"name":"Scientific Research Cultivation Project of Leshan Normal University","award":["KYPY202-0005"],"award-info":[{"award-number":["KYPY202-0005"]}]},{"name":"Scientific Award Winning Achievement Cultivation Project of Leshan Normal University","award":["KYHJ2023-0001"],"award-info":[{"award-number":["KYHJ2023-0001"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>Graph neural network (GNN) have demonstrated excellent performance in network traffic anomaly detection research. However, existing GNN-based approaches often lack interpretability, and their detection performance remains to be improved. To address these challenges, we propose XGA-E, an interpretability-enhanced GNN model for network traffic anomaly detection that leverages graph neural networks, explainable artificial intelligence (XAI) techniques, and gradient boosting-based anomaly detection classifiers. We developed the core architecture of XGA-E and established protocols for preprocessing network traffic data, based on which graph-structured representations were constructed from traffic features. To enable effective and interpretable anomaly detection, we further designed model training procedures alongside an interpretative analysis framework. We implemented XGA-E and evaluated its performance through simulation experiments on a public dataset. The results demonstrate that XGA-E outperforms existing models reported in the literature and exhibits strong performance in network traffic anomaly detection. Moreover, the XGA-E interpreter successfully identifies edges that are critical to the model\u2019s decision-making process.<\/jats:p>","DOI":"10.1186\/s42400-025-00487-x","type":"journal-article","created":{"date-parts":[[2026,1,9]],"date-time":"2026-01-09T10:29:44Z","timestamp":1767954584000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["XGA-E: an explainability-enhanced graph neural network for network traffic anomaly detection"],"prefix":"10.1186","volume":"9","author":[{"given":"Min","family":"Yang","sequence":"first","affiliation":[]},{"given":"Caiming","family":"Liu","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2026,1,9]]},"reference":[{"key":"487_CR1","doi-asserted-by":"publisher","DOI":"10.1016\/j.iot.2022.100656","volume":"21","author":"A Abusitta","year":"2023","unstructured":"Abusitta A, de Carvalho GH, Wahab OA et al (2023) Deep learning-enabled anomaly detection for iot systems. Internet of Things 21:100656","journal-title":"Internet of Things"},{"key":"487_CR2","doi-asserted-by":"crossref","unstructured":"Ak E, Canberk B (2020) Fsc: Two-scale ai-driven fair sensitivity control for 802.11 ax networks. In: GLOBECOM 2020-2020 IEEE Global Communications Conference, IEEE, pp 1\u20136","DOI":"10.1109\/GLOBECOM42002.2020.9322153"},{"key":"487_CR3","doi-asserted-by":"publisher","DOI":"10.1016\/j.compeleceng.2023.108732","volume":"108","author":"MM Alani","year":"2023","unstructured":"Alani MM (2023) An explainable efficient flow-based industrial iot intrusion detection system. Comput Electr Eng 108:108732","journal-title":"Comput Electr Eng"},{"issue":"1","key":"487_CR48","doi-asserted-by":"publisher","first-page":"53","DOI":"10.1186\/s40537-021-00444-8","volume":"8","author":"L Alzubaidi","year":"2021","unstructured":"Alzubaidi L, Zhang J, Humaidi AJ, et al (2021) Review of deep learning: concepts, cnn architectures, challenges, applications, future directions. J Big Data 8(1):53","journal-title":"J Big Data"},{"key":"487_CR4","doi-asserted-by":"publisher","DOI":"10.1016\/j.iot.2023.100936","volume":"24","author":"SA Bakhsh","year":"2023","unstructured":"Bakhsh SA, Khan MA, Ahmed F et al (2023) Enhancing iot network security through deep learning-powered intrusion detection system. Internet Things 24:100936","journal-title":"Internet Things"},{"key":"487_CR5","unstructured":"Baldassarre F, Azizpour H (2019) Explainability techniques for graph convolutional networks. arXiv preprint arXiv:1905.13686"},{"issue":"9","key":"487_CR6","doi-asserted-by":"publisher","first-page":"1616","DOI":"10.1109\/TKDE.2018.2807452","volume":"30","author":"H Cai","year":"2018","unstructured":"Cai H, Zheng VW, Chang KCC (2018) A comprehensive survey of graph embedding: Problems, techniques, and applications. IEEE Trans Knowl Data Eng 30(9):1616\u20131637","journal-title":"IEEE Trans Knowl Data Eng"},{"key":"487_CR7","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2022.110030","volume":"258","author":"E Caville","year":"2022","unstructured":"Caville E, Lo WW, Layeghy S et al (2022) Anomal-e: A self-supervised network intrusion detection system based on graph neural networks. Knowl-Based Syst 258:110030","journal-title":"Knowl-Based Syst"},{"key":"487_CR8","doi-asserted-by":"crossref","unstructured":"Chattopadhay A, Sarkar A, Howlader P, et\u00a0al (2018) Grad-cam++: Generalized gradient-based visual explanations for deep convolutional networks. In: 2018 IEEE winter conference on applications of computer vision (WACV), IEEE, pp 839\u2013847","DOI":"10.1109\/WACV.2018.00097"},{"key":"487_CR9","doi-asserted-by":"crossref","unstructured":"Friji H, Olivereau A, Sarkiss M (2023) Efficient network representation for gnn-based intrusion detection. In: International conference on applied cryptography and network security, Springer, pp 532\u2013554","DOI":"10.1007\/978-3-031-33488-7_20"},{"key":"487_CR10","doi-asserted-by":"crossref","unstructured":"Fu C, Li Q, Xu K, et\u00a0al (2023) Point cloud analysis for ml-based malicious traffic detection: Reducing majorities of false positive alarms. In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp 1005\u20131019","DOI":"10.1145\/3576915.3616631"},{"issue":"8","key":"487_CR11","doi-asserted-by":"publisher","first-page":"8687","DOI":"10.1109\/TKDE.2022.3201170","volume":"35","author":"T Funke","year":"2022","unstructured":"Funke T, Khosla M, Rathee M et al (2022) Zorro: Valid, sparse, and stable explanations in graph neural networks. IEEE Trans Knowl Data Eng 35(8):8687\u20138698","journal-title":"IEEE Trans Knowl Data Eng"},{"key":"487_CR12","doi-asserted-by":"crossref","unstructured":"Gillioz A, Riesen K (2023) Graph-based vs. vector-based classification: a fair comparison. In: International Workshop on Graph-Based Representations in Pattern Recognition, Springer, pp 25\u201334","DOI":"10.1007\/978-3-031-42795-4_3"},{"key":"487_CR13","unstructured":"Gilmer J, Schoenholz SS, Riley PF, et\u00a0al (2017) Neural message passing for quantum chemistry. In: International conference on machine learning, PMLR, pp 1263\u20131272"},{"issue":"2","key":"487_CR14","doi-asserted-by":"publisher","first-page":"374","DOI":"10.3390\/s25020374","volume":"25","author":"W Guo","year":"2025","unstructured":"Guo W, Du W, Yang X et al (2025) Malhapgnn: An enhanced call graph-based malware detection framework using hierarchical attention pooling graph neural network. Sensors 25(2):374","journal-title":"Sensors"},{"key":"487_CR15","unstructured":"Hamilton W, Ying Z, Leskovec J (2017) Inductive representation learning on large graphs. Advances in neural information processing systems 30"},{"issue":"1","key":"487_CR16","doi-asserted-by":"publisher","first-page":"538","DOI":"10.1109\/COMST.2022.3233793","volume":"25","author":"K He","year":"2023","unstructured":"He K, Kim DD, Asghar MR (2023) Adversarial machine learning for network intrusion detection systems: A comprehensive survey. IEEE Commun Surv Tutorials 25(1):538\u2013566. https:\/\/doi.org\/10.1109\/COMST.2022.3233793","journal-title":"IEEE Commun Surv Tutorials"},{"issue":"7","key":"487_CR17","doi-asserted-by":"publisher","first-page":"6968","DOI":"10.1109\/TKDE.2022.3187455","volume":"35","author":"Q Huang","year":"2022","unstructured":"Huang Q, Yamada M, Tian Y et al (2022) Graphlime: Local interpretable model explanations for graph neural networks. IEEE Trans Knowl Data Eng 35(7):6968\u20136972","journal-title":"IEEE Trans Knowl Data Eng"},{"key":"487_CR49","doi-asserted-by":"crossref","unstructured":"Kaya K, Ak E, Bas S, et al (2024) X-cba: explainability aided catboosted anomal- e for intrusion detection system. In: ICC 2024-IEEE International Conference on Communications, IEEE, pp 2288\u20132293","DOI":"10.1109\/ICC51166.2024.10622177"},{"key":"487_CR18","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2023.119000","volume":"639","author":"M Keshk","year":"2023","unstructured":"Keshk M, Koroniotis N, Pham N et al (2023) An explainable deep learning-enabled intrusion detection framework in iot networks. Inf Sci 639:119000","journal-title":"Inf Sci"},{"key":"487_CR19","doi-asserted-by":"crossref","unstructured":"Layman L, Roden W (2023) A controlled experiment on the impact of intrusion detection false alarm rate on analyst performance. In: Proceedings of the Human Factors and Ergonomics Society Annual Meeting, SAGE Publications Sage CA: Los Angeles, CA, pp 220\u2013225","DOI":"10.1177\/21695067231192573"},{"key":"487_CR20","unstructured":"Li X, Zhang J, Yuan Y, et\u00a0al (2023) Network intrusion detection with edge-directed graph multi-head attention networks. arXiv preprint arXiv:2310.17348"},{"key":"487_CR21","doi-asserted-by":"crossref","unstructured":"Lo WW, Layeghy S, Sarhan M, et\u00a0al (2022) E-graphsage: A graph neural network based intrusion detection system for iot. In: NOMS 2022-2022 IEEE\/IFIP Network Operations and Management Symposium, IEEE, pp 1\u20139","DOI":"10.1109\/NOMS54207.2022.9789878"},{"key":"487_CR22","doi-asserted-by":"publisher","DOI":"10.1016\/j.iot.2023.100747","volume":"22","author":"WW Lo","year":"2023","unstructured":"Lo WW, Kulatilleke G, Sarhan M et al (2023) Xg-bot: An explainable deep graph neural network for botnet detection and forensics. Internet of Things 22:100747","journal-title":"Internet of Things"},{"issue":"2","key":"487_CR23","doi-asserted-by":"publisher","first-page":"714","DOI":"10.3390\/app14020714","volume":"14","author":"C Lu","year":"2024","unstructured":"Lu C, Cao Y, Wang Z (2024) Research on intrusion detection based on an enhanced random forest algorithm. Appl Sci 14(2):714","journal-title":"Appl Sci"},{"key":"487_CR24","unstructured":"Lundberg SM, Lee SI (2017) A unified approach to interpreting model predictions. Advances in neural information processing systems 30"},{"key":"487_CR25","first-page":"19620","volume":"33","author":"D Luo","year":"2020","unstructured":"Luo D, Cheng W, Xu D et al (2020) Parameterized explainer for graph neural network. Adv Neural Inf Process Syst 33:19620\u201319631","journal-title":"Adv Neural Inf Process Syst"},{"key":"487_CR26","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2022.117120","volume":"201","author":"R Ma","year":"2022","unstructured":"Ma R, Guo F, Li Z et al (2022) Knowledge graph random neural networks for recommender systems. Expert Syst Appl 201:117120","journal-title":"Expert Syst Appl"},{"issue":"4","key":"487_CR27","first-page":"2705","volume":"16","author":"M Mirlashari","year":"2024","unstructured":"Mirlashari M, Rizvi SAM (2024) Enhancing iot intrusion detection system with modified e-graphsage: a graph neural network approach. Int J Inf Technol 16(4):2705\u20132713","journal-title":"Int J Inf Technol"},{"key":"487_CR28","doi-asserted-by":"publisher","first-page":"112392","DOI":"10.1109\/ACCESS.2022.3216617","volume":"10","author":"S Neupane","year":"2022","unstructured":"Neupane S, Ables J, Anderson W et al (2022) Explainable intrusion detection systems (x-ids): A survey of current methods, challenges, and opportunities. IEEE Access 10:112392\u2013112415","journal-title":"IEEE Access"},{"key":"487_CR29","doi-asserted-by":"publisher","DOI":"10.1016\/j.asoc.2019.105980","volume":"87","author":"M Prasad","year":"2020","unstructured":"Prasad M, Tripathi S, Dahal K (2020) An efficient feature selection based bayesian and rough set approach for intrusion detection. Appl Soft Comput 87:105980","journal-title":"Appl Soft Comput"},{"key":"487_CR30","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.102062","volume":"99","author":"M Prasad","year":"2020","unstructured":"Prasad M, Tripathi S, Dahal K (2020) Unsupervised feature selection and cluster center initialization based arbitrary shaped clusters for intrusion detection. Computers & Security 99:102062","journal-title":"Computers & Security"},{"key":"487_CR31","doi-asserted-by":"publisher","DOI":"10.1016\/j.engappai.2022.105760","volume":"119","author":"M Prasad","year":"2023","unstructured":"Prasad M, Tripathi S, Dahal K (2023) An intelligent intrusion detection and performance reliability evaluation mechanism in mobile ad-hoc networks. Eng Appl Artif Intell 119:105760","journal-title":"Eng Appl Artif Intell"},{"key":"487_CR32","doi-asserted-by":"publisher","first-page":"135","DOI":"10.1016\/j.neunet.2023.04.026","volume":"164","author":"C Qin","year":"2023","unstructured":"Qin C, Chen L, Cai Z et al (2023) Long short-term memory with activation on gradient. Neural Netw 164:135\u2013145","journal-title":"Neural Netw"},{"key":"487_CR33","doi-asserted-by":"crossref","unstructured":"Rosay A, Carlier F, Leroux P (2020) Feed-forward neural network for network intrusion detection. In: 2020 IEEE 91st Vehicular Technology Conference (VTC2020-Spring), IEEE, pp 1\u20136","DOI":"10.1109\/VTC2020-Spring48590.2020.9129472"},{"key":"487_CR34","doi-asserted-by":"crossref","unstructured":"Selvaraju RR, Cogswell M, Das A, et\u00a0al (2017) Grad-cam: Visual explanations from deep networks via gradient-based localization. In: Proceedings of the IEEE international conference on computer vision, pp 618\u2013626","DOI":"10.1109\/ICCV.2017.74"},{"issue":"2018","key":"487_CR35","first-page":"108","volume":"1","author":"I Sharafaldin","year":"2018","unstructured":"Sharafaldin I, Lashkari AH, Ghorbani AA et al (2018) Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSp 1(2018):108\u2013116","journal-title":"ICISSp"},{"key":"487_CR36","doi-asserted-by":"crossref","unstructured":"Tran DH, Park M (2024) Graph embedding for graph neural network in intrusion detection system. In: 2024 International Conference on Information Networking (ICOIN), IEEE, pp 395\u2013397","DOI":"10.1109\/ICOIN59985.2024.10572124"},{"key":"487_CR37","doi-asserted-by":"crossref","unstructured":"Van\u00a0Langendonck L, Castell-Uroz I, Barlet-Ros P (2024) Ppt-gnn: A practical pre-trained spatio-temporal graph neural network for network security. arXiv preprint arXiv:2406.13365","DOI":"10.1109\/EuroSPW67616.2025.00026"},{"key":"487_CR38","first-page":"12225","volume":"33","author":"M Vu","year":"2020","unstructured":"Vu M, Thai MT (2020) Pgm-explainer: Probabilistic graphical model explanations for graph neural networks. Adv Neural Inf Process Syst 33:12225\u201312235","journal-title":"Adv Neural Inf Process Syst"},{"key":"487_CR39","first-page":"432","volume-title":"Int Conf Knowl Sci","author":"C Wei","year":"2023","unstructured":"Wei C, Xie G, Diao Z (2023) Network flow based iot anomaly detection using graph neural network. Int Conf Knowl Sci. Springer, Engineering and Management, pp 432\u2013445"},{"issue":"1","key":"487_CR40","doi-asserted-by":"publisher","first-page":"4","DOI":"10.1109\/TNNLS.2020.2978386","volume":"32","author":"Z Wu","year":"2020","unstructured":"Wu Z, Pan S, Chen F et al (2020) A comprehensive survey on graph neural networks. IEEE trans neural net learn syst 32(1):4\u201324","journal-title":"IEEE trans neural net learn syst"},{"key":"487_CR41","doi-asserted-by":"crossref","unstructured":"Xiao Q, Liu J, Wang Q, et\u00a0al (2020) Towards network anomaly detection using graph embedding. In: Computational Science\u2013ICCS 2020: 20th International Conference, Amsterdam, The Netherlands, June 3\u20135, 2020, Proceedings, Part IV 20, Springer, pp 156\u2013169","DOI":"10.1007\/978-3-030-50423-6_12"},{"key":"487_CR42","doi-asserted-by":"publisher","first-page":"4370827","DOI":"10.1155\/int\/4370827","volume":"1","author":"F Ye","year":"2025","unstructured":"Ye F, Zhang K, Sun J et al (2025) (2025) An anomaly detection system for high-dimensional industry time series data based on gnn and apache flink. Int J Intell Syst 1:4370827","journal-title":"Int J Intell Syst"},{"issue":"10","key":"487_CR43","doi-asserted-by":"publisher","first-page":"1534","DOI":"10.3390\/math12101534","volume":"12","author":"X Ying","year":"2024","unstructured":"Ying X, Pan M, Chen X et al (2024) Research on virus propagation network intrusion detection based on graph neural network. Mathematics 12(10):1534","journal-title":"Mathematics"},{"key":"487_CR44","unstructured":"Ying Z, Bourgeois D, You J, et\u00a0al (2019) Gnnexplainer: Generating explanations for graph neural networks. Advances in neural information processing systems 32"},{"key":"487_CR45","unstructured":"Yuan H, Yu H, Wang J, et\u00a0al (2021) On explainability of graph neural networks via subgraph explorations. In: International conference on machine learning, PMLR, pp 12241\u201312252"},{"issue":"5","key":"487_CR46","doi-asserted-by":"publisher","first-page":"2894","DOI":"10.1109\/TNSE.2022.3184975","volume":"10","author":"Y Zhang","year":"2022","unstructured":"Zhang Y, Yang C, Huang K et al (2022) Intrusion detection of industrial internet-of-things based on reconstructed graph neural networks. IEEE Trans netw sci eng 10(5):2894\u20132905","journal-title":"IEEE Trans netw sci eng"},{"key":"487_CR47","doi-asserted-by":"publisher","first-page":"57","DOI":"10.1016\/j.aiopen.2021.01.001","volume":"1","author":"J Zhou","year":"2020","unstructured":"Zhou J, Cui G, Hu S et al (2020) Graph neural networks: A review of methods and applications. AI open 1:57\u201381","journal-title":"AI open"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-025-00487-x.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-025-00487-x","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-025-00487-x.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,9]],"date-time":"2026-01-09T10:29:49Z","timestamp":1767954589000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1186\/s42400-025-00487-x"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,1,9]]},"references-count":49,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2026,12]]}},"alternative-id":["487"],"URL":"https:\/\/doi.org\/10.1186\/s42400-025-00487-x","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,1,9]]},"assertion":[{"value":"1 July 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"23 September 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"9 January 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no Competing interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interest"}}],"article-number":"99"}}