# Anomaly Detection in Network Traffic via Cross-Domain Federated Graph Representation Learning
## 3 Related Works
### Network Traffic Anomaly Detection Based on Federated Learning  
The widespread deployment of Internet of Things (IoT) and edge computing devices has significantly increased the complexity and decentralization of network environments, leading to the dispersion of data across multiple locations rather than its concentration on a single central server. The rapid proliferation of smart devices generates vast amounts of network traffic data, generally containing sensitive information that is distributed across diverse geographic regions and administrative domains. Traditional centralized data processing methods require aggregating all network traffic data onto a central server for analysis. However, the central server is constrained by limited computational power, storage capacity, and network bandwidth. As the system scales, the workload increases, or malicious attacks occur, the central server may become incapable of meeting system demands, resulting in performance degradation, prolonged response times, or even complete system failure. Moreover, adversaries can potentially infer sensitive private data from the global model aggregated by the central server. Consequently, any security breach targeting the central server poses a severe risk of privacy leakage.  
With the growing demand for data privacy protection and the rapid proliferation of distributed devices, federated learning has emerged as a prominent research direction in the field of network anomaly detection. Against this backdrop, an increasing number of studies have explored the application of federated learning to network traffic anomaly detection tasks, aiming to enable distributed and privacy-preserving threat awareness and analysis. [PERSON] et al. [23] proposed an FL framework based on deep neural networks for network anomaly detection on resource-constrained devices. However, their approach assumes that all clients share similar data distributions and does not adequately address the variability of traffic features in non-IID settings. [PERSON] et al. [24] applied FL to IoT environments by training deep learning classifiers to detect various types of attacks, yet their method similarly relies on the assumption of consistent data sources across clients. [PERSON] et al. [25] constructed an attention-based graph neural network within the FL framework to detect cross-level network attacks. Although their approach achieved promising performance, it still remains constrained by the modeling limitations of single-domain data distributions. [PERSON] et al. [26] introduced FADngs, a method that enhances privacy protection by sharing density functions instead of raw data. Nevertheless, the method does not explicitly address the generalization challenges caused by heterogeneous client data distributions. Although these methods perform well in preserving data privacy and enabling distributed detection, they usually assume that client data comes from a single domain or has a similar distribution. This assumption limits the generalization ability of the global model, particularly in the non-IID setting, where the traffic patterns of different clients vary significantly. Recent research [27] has pointed out that different graph domains often share common structural properties, which opens up new opportunities for cross-domain knowledge transfer. However, existing FL approaches have rarely explored this potential. Therefore, our work aims to address this limitation by incorporating cross-domain structural guidance into the federated training process, thereby achieving more robust representation learning in the non-IID setting.