# Anomaly Detection in Network Traffic via Cross-Domain Federated Graph Representation Learning
## 4 Methods
### Graph Structure Construction Module  
Figure 2 illustrates the process of constructing a graph from network traffic data. Firstly, key information is extracted from each traffic flow in the dataset. This information includes the source IP address, destination IP address, source port, destination port, protocol type, flow duration, total number of packets, and label. The source IP address and destination IP address, which serve as the basis for constructing the graph data, are considered nodes, while information such as the flow duration and total number of packets is considered edge features. For the purpose of a graph classification task using a GNN, node features are generated by aggregating the features of the incoming and outgoing edges associated with that node. In addition, the structural information of the graph is obtained by two encoding methods: degree-based encoding and random walk-based encoding. In most traditional graph neural network frameworks, node representations are obtained through a feature aggregation process that integrates structural information and node features into each node's representation. However, in distributed learning scenarios, node features may contain sensitive information (such as traffic patterns or access logs of individual devices). In this paper, the structural knowledge of the graph is independently represented and learned in the form of vectors. This separation of structural knowledge learning from node features effectively prevents sensitive information from being exposed to the global model, thereby enhancing privacy protection. In AD-FG, structural embeddings containing both local and global structural patterns are constructed, and this combination helps the model understand the structure and function of the graph more comprehensively. For local structural knowledge, degree-based structure embedding (DE) is used, which creates a one-hot encoding by the degree of a node. For a node \(v\) in the graph, its DE is denoted as follows:  
\[s_{v}^{\text{DE}}=[e_{1},e_{2},\ldots,e_{k-1},e_{k}] \tag{2}\]  
Figure 1: The overall framework of AD-FG. where \(e_{i}\) is defined by  
\[e_{i}= \begin{cases}1,&\text{if }i=d_{v}\text{ and }i<k\\ 1,&\text{if }d_{v}\geq k\text{ and }i=k\\ 0,&\text{otherwise}\end{cases}  \tag{3}\]  
Here, \(d_{v}\) is the degree of node \(v\), representing the number of edges directly connected to it, which reflects the centrality of the node within its local subgraph, while \(k\) is the dimension of DE, which is used to generate a fixed-length structural embedding vector. Specifically, when the degree \(d_{v}\) is less than the predefined dimension \(k\), the \(d_{v}\)th position in the vector is set to one, and all other positions are set to zero. When \(d_{v}\geq k\), the last position (the \(k\)th position) is set to one, indicating that degrees exceeding the upper limit are grouped into a single category. DE is used because the degree is one of the most basic and intuitive attributes of a node in a graph for expressing the local connectivity of a node. By directly converting the degree of a node to an embedding vector, the local structural characteristics of a node can be captured succinctly and efficiently, and the one-time degree-based embedding is computationally friendly, which avoids the high computational cost of embedding initialization. Meanwhile, in order to obtain global structural knowledge, a random walk-based embedding (RWE) is introduced, which is computed based on the random walk diffusion process [28; 29]. Specifically, RWE is denoted as follows:  
\[s_{v}^{\text{RWE}}=[p_{v}^{1},\ p_{v}^{2},\ \ldots,\ p_{v}^{k}] \tag{4}\]  
where \(p_{v}^{k}=(T^{k})_{vv}\) denotes the probability that node \(v\) returns to itself after \(k\) steps of the random walk. This probability is calculated using the random walk transition matrix \(T=AD^{-1}\), where \(A\) is the adjacency matrix of the graph and \(D\) is the diagonal degree matrix.