SHAP-GSD: Temporal Multi-Granular Explanation Method for Graph Neural Networks in Network Intrusion Detection

Abstract

In graph neural network (GNN)-based network intrusion detection systems (NIDS), an alert may reflect flow attributes, recent endpoint communications, or anomalous endpoint behaviour. Feature-only Shapley methods identify which flow attributes triggered the flag, but cannot attribute temporal neighbourhood context or endpoint novelty. This paper presents SHapley Additive exPlanations on Graph-Structured Data (SHAP-GSD), a temporally constrained Shapley framework that decomposes each alert into three attribution layers: 48 semantic feature groups, temporal-neighbourhood flows within a strict per-edge cut-off admitting only evidence available at the moment of detection, and a node-level coalition combining rolling endpoint state with a binary first-appearance flag. On the NF-UNSW-NB15-v3 dataset, SHAP-GSD improves macro-F1 by 6.33% over TE-G-SAGE under the identical chronological split. Temporal-neighbourhood evidence is present on roughly half of explained flows, and semantic grouping concentrates attribution within a small subset of the 48 named groups, scoring higher on both necessity and sufficiency than the ungrouped dimensions at matched masking scope, so readability costs no fidelity. A Shellcode case study shows the temporal neighbourhood weighs against the alert and the endpoint first-appearance flag makes zero contribution, distinctions a single-granularity explainer would collapse into one undifferentiated score. SHAP-GSD is the first Shapley formulation to simultaneously deliver temporally faithful, multi-granularity attribution across all three evidence dimensions for a GNN-based NIDS.