CTGAD-X: Explainable Contrastive Learning on Temporal Graphs for Advanced Threat Detection

Advanced persistent threats (APTs) and zero-day attacks evade signature-driven and fully supervised intrusion detection, motivating the development of anomaly detectors that generalize to unseen behaviors while remaining interpretable in high-stakes operations. Existing temporal graph neural network (GNN) detectors often rely on reconstruction objectives and offer limited transparency, which can weaken the separability of novel threats and reduce analyst trust. We propose CTGAD-X, an explainable self-supervised framework for zero-day threat detection on temporal graphs. CTGAD-X learns a discriminative normal embedding space from benign traffic using contrastive learning and flags anomalies based on distance-based deviation from a normal reference set. To ensure temporal correctness, we introduced causality-aware overlap-based flow slicing and validated window-level attribution against raw PCAP packet timestamps, achieving strong agreement (Pearson$r=0.943$; median relative error 3.2% for bytes and 2.0% for packets). On UNSW-NB15 under causality-aware slicing, CTGAD-X achieves ROC-AUC$=0.9908$and F1-score$=0.9888$. In the zero-day leave-one-out evaluation, held-outExploitsincrease from$\approx 88.8\%$detection at a deployable low-false-alarm (fixed-threshold) point to$100\%$at a higher sensitivity. Similarly,Genericincreases from$\approx 65.5\%$to$100\%$, quantifying the recall–false-alarm trade-off. To support operational transparency, CTGAD-X integrates a multi-level XAI module (attention attribution, input perturbation, and global permutation importance) and validates explanation via feature-masking and perturbation tests. We further evaluated cross-dataset generalization on multiple benchmark datasets using a transfer learning with minimal adaptation. CTGAD-X is lightweight (16,320 parameters) and achieves 3.94ms encoder inference per sequence, enabling practical deployment in high-throughput environments. Finally, CTGAD-X unifies temporally consistent graph construction, contrastive representation learning, and reliable explanations to enable reliable zero-day detection.