# Anomaly Detection in Network Traffic via Cross-Domain Federated Graph Representation Learning
## 4 Methods
### Federated Collaborative Learning Module
#### 4.3.2 Cross-Gated Feature Fusion Mechanism  
The decoupled graph neural network uses two different information flow channels to extract features from feature knowledge and structural knowledge to establish a reasonable relationship between \(h_{v}\) and \(g_{v}\) for a comprehensive representation of the network flow graph. To this end, a fusion mechanism called the cross-gated feature fusion mechanism is specifically designed as shown in Figure 3 to fuse \(h_{v}\) and \(g_{v}\) into the final encoded feature vector of the network flow graph.  
Two filters are used, each including two linear layers, with a ReLU activation function between the two layers. First, the two filters, which do not share parameters, are applied to \(h_{v}\) and \(g_{v}\), and then an element-by-element sigmoid function is used to scale each element to the range [0, 1]. The scaled vectors are regarded as gated vectors, and the corresponding \(h_{v}\) and \(g_{v}\) are cross-filtered using them. This mechanism can effectively combine the features (packet sizes, flow rates, etc.) and structural information (e.g., connectivity patterns among the nodes) of a network flow. This fusion not only improves the distinguishing power of the features but also enables the model to capture potential threats and anomalous behaviors from more dimensions. The cross-gated feature fusion mechanism allows each type of information to weight and filter the other. This means that the model can focus on key information that best characterizes and explains the current network situation, thereby filtering out irrelevant or secondary data. For example, if certain feature information is not critical for a particular type of anomaly detection, then this mechanism can reduce the weight of this information and vice versa. The cross-gated feature fusion mechanism can be represented by  
\[s_{g}=\text{Sigmoid}(W_{h2}^{T}\text{ReLU}(W_{h1}^{T}g_{v}+b_{h1})+b_{h2}) \tag{7}\]  
\[s_{h}=\text{Sigmoid}(W_{g2}^{T}\text{ReLU}(W_{g1}^{T}h_{v}+b_{g1})+b_{g2}) \tag{8}\]  
\[h_{C}=\text{READOUT}(\text{CONCAT}(s_{g}\odot h_{v},\,s_{h}\odot g_{v})) \tag{9}\]  
\(W_{h1},W_{h2},W_{g1},W_{g2}\in R^{(d_{g}\times d_{g})}\) are the weights of the linear layer, \(b_{h1},b_{h2},b_{g1},b_{g2}\in R^{d_{g}}\) are the deviations of the linear layer, and the symbol \(\odot\) denotes any element-level products, which are finally connected together and passed through a readout function to obtain the graph-level embedding \(h_{C}\). This graph embedding is then fed into a softmax classifier to perform graph classification. In the last step, the cross-entropy according to the graph classification task loss \(\mathcal{L}_{m}\) is optimized. The set of learnable parameters for the mth client is denoted by \(W_{m}=\{W_{h,m},W_{g,m}\}\), where \(W_{h,m}\) denotes the parameters of the feature encoder and \(W_{g,m}\) denotes the parameters of the structure encoder. They are updated during the local training process as follows:  
\[W_{h,m}^{*},W_{g,m}^{*}=\arg\min_{W_{h,m},W_{g,m}}\mathcal{L}_{m}(W_{m};D_{m}) \tag{10}\]  
where \(\mathcal{L}_{m(W_{m};D_{m})}\) is the loss function of client \(m\) on the local dataset \(D_{m}\).