# Graph Convolution Neural Network and Deep Q-Network Optimization-Based Intrusion Detection with Explainability Analysis

## TL;DR

This paper introduces a new intrusion detection model combining graph networks and deep learning, showing better accuracy and explainability for network security.

## Contribution

The novel GCN-DQN model integrates graph convolution with attention and reinforcement learning for adaptive intrusion detection.

## Key findings

- GCN-DQN achieved higher classification accuracy than baseline models on intrusion detection datasets.
- LIME and SHAP techniques were successfully used to explain the model's decisions.
- The model adapts attention weights to improve performance on complex network correlations.

## Abstract

As networks expand in size and complexity, coupled with an exponential increase in intrusions on network and IoT systems, this leads to traditional models failing to capture increasingly intricate correlations among network components accurately. Graph Convolution Networks (GCNs) have recently acquired prominence for their capacity to represent nodes, edges, or entire graphs by aggregating information from adjacent nodes. However, the correlations between nodes and their neighbours, as well as related edges, differ. Assigning higher weights to nodes and edges with high similarity improves model accuracy and expressiveness. In this paper, we propose the GCN-DQN model, which integrates GCN with a multi-head attention mechanism and DQN (Deep Q Network) to adaptively adjust attention weights optimizing its performance in intrusion detection tasks. After extensive experiments using the UNSW NB15 and CIC-IDS2017 dataset, the proposed GCN-DQN outperformed the baseline model in classification accuracy. We also applied LIME and SHAP techniques to provide explainability to our proposed intrusion detection model.