Graph Neural Networks with Multi-Head Attention and SHAP-Based Explainability for Robust, Interpretable, and High-Throughput Intrusion Detection in 5G-Enabled Software Defined Networks

The rapid evolution of 5G-enabled Software Defined Networks (SDNs) has transformed modern communication systems by enabling ultra-low latency, massive connectivity, and high throughput. However, the increased complexity of traffic flows and the rise of sophisticated cyber-attacks such as Distributed Denial of Service (DDoS), Botnets, Fake Base Stations, and Zero-Day exploits have made intrusion detection a critical challenge. Traditional Intrusion Detection System (IDS) approaches often suffer from poor gen-eralization, high false positives, and lack of interpretability, making them unsuitable for dynamic 5G environments. This paper presents a novel Graph Neural Network (GNN) with Multi-Head Attention (MHA) and SHAP-based explainability for robust, interpretable, and high-throughput intrusion detection in 5G-SDN. The model is evaluated on the NGIDS-DS and 5G-NIDD datasets, along with a real-time 5G testbed, and achieves a detection accuracy of 98.67% and a detection rate of 99.20%, outperforming baseline IDS models (92.15% accuracy and 89.42% detection rate). Latency is reduced to 24.6 ms compared to 47.3 ms in existing methods, while throughput improves from 7420 flows/sec to 11,384 flows/sec, demonstrating scalability under 5G traffic loads. Furthermore, the integration of SHAP ensures an Interpretability Confidence Score (ICS) of 0.92, providing transparency in decision-making for security-critical applications. The proposed framework significantly enhances detection robustness, reduces overhead, and maintains compliance with 5G Ultra-Reliable Low-Latency Communication (URLLC) performance thresholds, making it a strong candidate for real-world 5G deployments.