# Anomaly Detection in Network Traffic via Cross-Domain Federated Graph Representation Learning
## 3 Related Works
### Network Traffic Anomaly Detection Based on Graph Neural Networks  
Network traffic can essentially be abstracted as a graph structure composed of multiple nodes and edges. In this representation, nodes typically denote concrete network entities such as IP addresses, hosts, or routers, while edges characterize the communication relationships between these entities, thereby reflecting the structuraldependencies among traffic flows. Such edges are generally constructed based on observed network behaviors--for example, connections between source and destination addresses or interaction paths among different flows--thus forming explicit communication links. This connectivity reveals the underlying topological structure of network communication and captures various latent organizational patterns. Given these inherent graph-structured properties of network traffic, GNNs serve as a natural and effective modeling tool for traffic anomaly detection tasks.  
Training GNN models has proven effective in distinguishing between normal and anomalous network traffic. In recent years, an increasing number of studies have leveraged graph structures to model the relationships among network flows, aiming to enhance the detection of complex dependency patterns. Most of these approaches apply GNNs to node-level or edge-level anomaly detection tasks. For example, [PERSON] et al. [16] realized network flow detection by representing network flows as nodes in a graph via a GCN-TC method and utilizing graph convolutional networks (GCN) for node classification; [PERSON] et al. [17] constructed a bipartite graph and transformed it into a line graph, converting the original edge classification task into a node classification task; [PERSON] et al. [18] leveraged graph attention networks (GAT) to learn the fusion features of topological graphs and finally classify them through fully connected layers and softmax functions to accomplish node-level detection of network traffic; [PERSON] et al. [19] and [PERSON] et al. [20] focused on edge-level classification, integrating edge features through variants of E-GraphSAGE; [PERSON] et al. [21] augmented the GCN model to learn the host and network features in the graph structure and accomplished edge-level traffic detection through a two-layer GCN; and [PERSON] et al. [22] proposed a hybrid model combining GraphSAGE and GAT architectures, utilizing dynamic feature extraction mechanisms to build an efficient network state representation system, but the model still generated node-level or edge-level predictions.  
These approaches have achieved a certain degree of success. However, they primarily focus on node-level and edge-level tasks, emphasizing local information within the network, such as anomalous behavior of individual nodes or abnormal interaction patterns between node pairs. In real-world complex network environments, attackers often adopt coordinated multi-point strategies or disguise their actions through multi-path behaviors. Such attacks are no longer limited to the anomalies of a certain node or edge but appear in a more macroscopic structural pattern, and their manifestation has obvious graph structure characteristics. Consequently, detection strategies that rely solely on local information at the node or edge level are insufficient for effectively identifying these distributed and structurally organized anomalous behaviors.  
To address the aforementioned challenges, it is essential to explore anomaly detection methods based on graph classification. By leveraging a GNN to uncover latent structural information across the entire network, capture global relationships, and extract multi-level features, these approaches can effectively learn complex structural patterns and potential high-order dependencies embedded within the graph. This enables comprehensive graph-level representation learning and offers novel perspectives and technical means for network traffic anomaly detection.