Open Access

ARTICLE

Graph Neural Networks with Multi-Head Attention and SHAP-Based Explainability for Robust, Interpretable, and High-Throughput Intrusion Detection in 5G-Enabled Software Defined Networks

Sarmad Dheyaa Azeez¹, Muhammad Ilyas^2,*, Saadaldeen Rashid Ahmed^3,4

1 Department of Electrical and Computer Engineering, Altinbas university, Istanbul, Türkiye
2 Department of Cybersecurity, College of Engineering, Al Ain University, Abu Dhabi, United Arab Emirates
3 Artificial Intelligence Engineering Department, College of Engineering, Al-Ayen University, Thi-Qar, Iraq
4 Computer Science, Bayan University, Erbil, Kurdstan, Iraq

* Corresponding Author: Muhammad Ilyas. Email:

(This article belongs to the Special Issue: Advances in Machine Learning and Artificial Intelligence for Intrusion Detection Systems)

Computers, Materials & Continua 2026, 87(3), 66 https://doi.org/10.32604/cmc.2026.074930

Received 21 October 2025; Accepted 28 January 2026; Issue published 09 April 2026

Abstract

The rapid evolution of 5G-enabled Software Defined Networks (SDNs) has transformed modern communication systems by enabling ultra-low latency, massive connectivity, and high throughput. However, the increased complexity of traffic flows and the rise of sophisticated cyber-attacks such as Distributed Denial of Service (DDoS), Botnets, Fake Base Stations, and Zero-Day exploits have made intrusion detection a critical challenge. Traditional Intrusion Detection System (IDS) approaches often suffer from poor gen-eralization, high false positives, and lack of interpretability, making them unsuitable for dynamic 5G environments. This paper presents a novel Graph Neural Network (GNN) with Multi-Head Attention (MHA) and SHAP-based explainability for robust, interpretable, and high-throughput intrusion detection in 5G-SDN. The model is evaluated on the NGIDS-DS and 5G-NIDD datasets, along with a real-time 5G testbed, and achieves a detection accuracy of 98.67% and a detection rate of 99.20%, outperforming baseline IDS models (92.15% accuracy and 89.42% detection rate). Latency is reduced to 24.6 ms compared to 47.3 ms in existing methods, while throughput improves from 7420 flows/sec to 11,384 flows/sec, demonstrating scalability under 5G traffic loads. Furthermore, the integration of SHAP ensures an Interpretability Confidence Score (ICS) of 0.92, providing transparency in decision-making for security-critical applications. The proposed framework significantly enhances detection robustness, reduces overhead, and maintains compliance with 5G Ultra-Reliable Low-Latency Communication (URLLC) performance thresholds, making it a strong candidate for real-world 5G deployments.

---

Keywords

---