# Anomaly Detection in Network Traffic via Cross-Domain Federated Graph Representation Learning
## 5 Experiments and Results  
### Experimental Set-Up  
#### 5.1.1 Dataset and Parameter Settings  
The CIC-IDS 2017 dataset was generated by the Canadian Institute for Cyber Security Research. A total of five days of data were collected from 3 July to 7 July 2017, with a small period of time taken each day for traffic collection. The dataset contains 2.83 million data flows, including 550,000 anomalous attack flows and 2.28 million normal data flows. The traffic data needed to be preprocessed in a uniform manner before they were fed into the model. Detailed statistics for the dataset are shown in Table 1. To better understand the distribution of anomalous and benign traffic within the dataset, we further provide a breakdown of the traffic types and their corresponding flow counts in Table 2.  
Graph construction: Nodes in the graph are identified with IPs, and directed edges are created based on the source and destination IPs of each flow. Since the flow features provided by the dataset are edge features, the features of the incoming and outgoing edges connected to the nodes are accumulated as node features. Normalization: The features of the nodes and the adjacency matrix of the graph are normalized, the node features are normalized according to the degree, and the adjacency matrix is taken to be normalized based on the random walk. Graph segmentation: The size of the graph can be determined according to the actual requirements, such as the attack period to be detected, the amount of network communication, and the size of the network. According to the size of the dataset used in the experiment, a topology graph was constructed every 500 graph flows in chronological order. Graph labeling: If there are anomalous flows in the graph, then the graph is labeled as malicious; otherwise, it is labeled as benign. A total of 5660 graphs were constructed in the dataset, and 70% of the graph data were randomly selected as the training set, while 15% were the validation set and 15% were the test set. Ten clients were involved in the training, each with 395 training graphs and 84 validation graphs. The server selected the IMDB-BINARY dataset of the social domain for training. In this paper, we use a three-layer GCN as the structure encoder and a three-layer Graph isomorphism network (GIN) as the feature encoder, both with hidden layers of \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Dataset** & \begin{tabular}{c} **Number of** \\ **Nodes** \\ \end{tabular} & \begin{tabular}{c} **Number of** \\ **Edges** \\ \end{tabular} & \begin{tabular}{c} **Time** \\ **Duration** \\ \end{tabular} & \
\begin{tabular}{c} **Number of** \\ **Graphs** \\ \end{tabular} & **Attack Type** \\ \hline
\begin{tabular}{c} CIC-IDS \\ 2017 \\ \end{tabular} & 19,211 & 2,824,000 & 5 days & 5650 & 14 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: CIC-IDS 2017 dataset introduction. \begin{table}
\begin{tabular}{l c} \hline \hline
**Network Traffic Type** & **Quantity (Flows)** \\ \hline \
\begin{tabular}{l} Benign \\ DoS Hulk \\ PortScan \\ \end{tabular} &
\begin{tabular}{c} 2,273,097 \\ 158,930 \\ 128,027 \\ 10,293 \\ 5897 \\ 5796 \\ 5499 \\ 1966 \\ 1507 \\ 1507 \\ 152 \\ 153 \\ 154 \\ 1552 \\ 156 \\ 157 \\ 158 \\ 159 \\ 1507 \\ 152 \\ 151 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Dataset details: types of network traffic in CIC-IDS 2017. 64 neurons each. The dimensions of both the DE and RWE were 32. The number of local iterations and batch size were \(1\) and 64, respectively. An Adam [31] optimizer was used with a weight decay of \(5\times 10^{-4}\) and a learning rate of \(1\times 10^{-4}\). The number of communication rounds for all FL methods was 200. To optimize model performance, we performed a small-scale grid search on the validation set for key hyperparameters while keeping the less sensitive ones fixed.