# Anomaly Detection in Network Traffic via Cross-Domain Federated Graph Representation Learning
## 4 Methods
### Federated Collaborative Learning Module
#### 4.3.1 Feature-Structure Decoupled Graph Neural Network  
In existing graph neural networks, structural information is typically encoded implicitly through aggregation with node features. However, in the context of federated graph learning, directly uploading node features may pose privacy risks for users, especially in scenarios where nodes contain highly sensitive information, such as user behavior patterns, traffic content, or access logs. To explicitly mitigate these privacy risks, our approach separates the encoding and learning processes of the graph structure and node attributes. This separation significantly enhances privacy protection, as it ensures that only structural information is transmitted to the central server, and such information inherently contains minimal sensitive details. The sensitive node attribute information remains securely stored and processed locally on each client, thereby preventing potential privacy leakage caused by centralized data aggregation or exposure. Moreover, in large-scale graph data scenarios, jointly processing both node features and topological structures can be computationally intensive. By decoupling these two components, the system can independently optimize storage and computation strategies. This separation not only enhances privacy protection but also significantly reduces the volume of data exchanged during each communication round. Such reduction is particularly beneficial in low-power IoT environments [30], where devices are typically constrained by limited energy and bandwidth resources.  
Therefore, inspired by [PERSON] et al. [28], a feature-structure decoupled graph neural network is proposed. As shown in Figure 3, it learns feature knowledge and structure knowledge through two parallel channels, respectively. In the structure-based channel, the structure encoder focuses on learning the structural information of the graph. This encoder operates on initial structural embeddings derived from degree-based and random walk-based encoding. It utilizes the message-passing mechanism of graph neural network layers to extract and propagate structural information, iteratively aggregating the structural  
Figure 3: Federated collaborative learning module.  
properties of each node and its neighbors across multiple layers. By being independent of feature data, this approach enables the model to more accurately capture and leverage the topological properties of the graph. This structurally focused independent channel ensures that the model effectively learns complex network relationships purely from graph connectivity. In the feature-based channel, the feature encoder is responsible for extracting and learning useful information from the raw feature data of the nodes. This process involves aggregating feature information from the nodes themselves and their neighbors at each layer of the network to form an information-rich hidden layer embedding. Formally, for an \(l\)-layer feature encoder \(f_{h}^{(l)}\), its \(l\)th layer hidden feature embedding \(h^{(l)}\) can be expressed as follows:  
\[h^{(l)}=f_{h}^{(l)}([h^{(l-1)}\|s^{(l-1)}]) \tag{6}\]  
where \(h^{(l-1)}\) is the feature embedding at layer \(l-1\), \(s^{(l-1)}\) is the structural embedding at layer \(l-1\), and \(\|\) represents the concatenation operation, which combines the feature and structural embeddings into a new input vector. In this way, the feature encoder can further utilize the structural knowledge learned by the structural encoder to generate feature embeddings that provide supplementary information for representation learning.