# Anomaly Detection in Network Traffic via Cross-Domain Federated Graph Representation Learning
## 1 Introduction  
In the era of digitization and intelligence, network traffic anomaly detection has become the key to measuring network health. A network traffic anomaly refers to the phenomenon where the behavior of network traffic deviates significantly from its normal state, which will deteriorate the normal operation of the network, leading not only to network performance degradation but also possibly data privacy leakage and other security issues [1]. For example, malware propagation, abnormal port scans, and other network attacks can generate abnormal network traffic, seriously threatening data security and network stability. Therefore, network traffic anomaly detection is one of the important means to ensuring network security. Network traffic anomaly detection is a crucial technique that identifies irregularities by analyzing network communication data. Among its various approaches, static data analysis stands out as a significant research direction. This method focuses on offline analysis of pre-collected and stored network traffic data, aiming to uncover hidden patterns andfeatures within historical traffic to detect abnormal behavior. Traditional static detection approaches often rely on manual feature extraction and rule-based strategies, such as thresholding, clustering-based anomaly identification, and classical machine learning algorithms like support vector machine (SVMs) and decision trees [2]. Although these approaches have shown a certain level of effectiveness, they exhibit significant limitations when confronting modern advanced attacks. Such attacks often employ complex and multi-stage strategies, such as advanced persistent threats (APTs) and distributed denial of service (DDoS) attacks, which are characterized by distinct structural features [3]. For instance, DDoS attacks often involve a large number of distributed nodes simultaneously communicating with a single target node, resulting in a high-density, star-shaped subgraph centered on the target. In contrast, APT attacks are highly progressive and feature complex attack paths and lateral movements involving multiple hops and communication routes, making them difficult to detect through isolated traffic features alone. Traditional machine learning methods, lacking the ability to model structural relationships among traffic flows effectively, struggle to accurately capture the coordinated patterns underlying such attacks. Recent studies have demonstrated that abstracting network traffic into a graph structure is an effective modeling approach, where nodes represent entities such as IP addresses or devices and edges correspond to communication events between these entities [4]. This graph-based abstraction enables the explicit capture of topological dependencies among traffic flows and entities, thereby providing graph-based methods with a natural advantage in anomaly detection tasks. Among them, graph neural networks (GNNs) have emerged as powerful tools for analyzing complex interactions and latent structural patterns within graphs due to their superior structural modeling capabilities. However, most GNN-based models are developed under centralized settings, where access to all data is assumed. This assumption raises significant privacy concerns and limits the practicality of such models in real-world applications. In addition, network traffic data are naturally distributed among different network environments, devices, or organizations. This distribution characteristic makes centralized data collection methods not only generate high communication overhead and delay but also make them more likely to lead to privacy leakage of sensitive data. Federated learning (FL) [5] provides an effective solution to the above problems by enabling cross-device collaborative model training without sharing original data. However, traditional federated learning frameworks usually rely on a single source of network traffic data local to each client.