Towards Context-Aware Structural Explainability in GNN-Based Intrusion Detection

Abstract

Intrusion detection systems based on Graph Neural Networks (GNNs) achieve strong predictive performance by modeling relational dependencies within network traffic; however, their opaque decision processes limit operational deployment in security analysis environments. This study introduces a context‑aware structural explainability framework that augments GNN‑based intrusion detection with relationally grounded explanations designed to support expert decision-making. The framework integrates node‑level attributes, multi‑hop neighborhood aggregation, and attack‑specific contextual cues to reconstruct the propagation of malicious behaviors across interconnected flows. The approach is evaluated on the CICIDS2017 dataset using large‑scale graph representations, with multiple GNN architectures benchmarked against traditional machine learning baselines under cross‑validation. While tabular models achieve high accuracy, their feature‑attribution explanations remain confined to isolated statistical contributions. In contrast, the proposed framework provides highly consistent and human‑centric structural explanations that capture distributed relational reasoning inherent in graph representations. Experimental results demonstrate that the framework enhances interpretability and trust calibration while maintaining competitive detection performance. The contribution lies in extending existing explainability approaches toward operationally meaningful, context‑aware reasoning, thereby offering practical value as an analyst‑oriented decision support system for Cybersecurity operations.