Poster: Detecting Network Anomalies from Small Trafﬁc Samples using Graph Neural Network Aviv Yehezkel Cynamics Israel aviv@cynamics.ai Eyal Elyashiv Cynamics Boston, US eyal@cynamics.ai Abstract—Detecting anomalies in computer networks is a classic, long-term research problem. While almost every kind of model architecture has been proposed, previous works usually analyzed the entire network trafﬁc. However, such analysis implies high memory and processing overhead, and is becoming less applicable for large networks. In this poster we present a work in progress which studies a previously under-researched setting where only a small fraction of the network trafﬁc is given. Our approach pre-processes the samples and transforms the computer network into a graph neural network (GNN). It distills node features, edge features and graph representations to learn a vector embedding for each endpoint which characterizes its normal behaviors. Then, a link predictor model is used to estimate the likeli- hood of network communications and detect anomalies. Index Terms—Deep-Learning; Graph Neural Network; Net- work Anomaly Detection; Network Security 1. Introduction Detecting anomalies in computer networks is a classic, long-term research problem. Almost every kind of model architecture has been studied: statistical, clustering, clas- siﬁcation, information-theory, deep-learning, and others (see [1] for a recent comprehensive survey on network anomaly detection). Speciﬁcally, various learning-based approaches were used [2]–[6]. However, previous works were based on analyzing the entire network trafﬁc, which is less applicable for large networks. A much less-studied approach is the sampling ap- proach, which is especially suitable for high-speed (gigabit or more) or high throughput networks, where only a small fraction of the packets (for example 1%) is being sampled and summarized [7]. In a recent work, we showed how a small percent of uniform sampling can be used to efﬁciently and accurately detect network anomalies and attacks using the concept of ”auto-encoder losses transfer learning” [8]. Our approach collected 1% network samples for each client, trained an auto-encoder neural network for each client’s network and then normalized all auto-encoder losses of the different clients, providing the ability to transform loss vectors of different client networks with potentially signiﬁcant varying characteristics, properties, and behaviors into a similar statistical distribution. The normalized losses can then be forwarded to a global detection model that detects and classiﬁes threats in a generalized way that is agnostic to the speciﬁc client. We used extensive simulation study to compare the ”sampled” approach to the existing “un- sampled” state-of-the-art approach and showed its superior detection accuracy. In this poster, we present a work in progress which intends to take our previous research one step deeper in the network - from the gateways to the endpoints. The proposed approach will transform the computer network into a graph neural network (GNN). It will distill node features, edge features and graph representations to learn a vector embedding for each endpoint which characterizes its normal behaviors. Then, a link predictor model will be used to estimate the likelihood of network communica- tions and detect anomalies in the endpoint level. As this work is still in progress, the poster abstract will mainly present our research idea and approach, without providing evaluations and preliminary results. In addition to the lower processing cost, a sampling- based network anomaly detection approach has many ad- vantages, such as: (a) Data privacy: the packet’s payload is not analyzed at any moment; (b) built-in robustness against sophisticated attacker utilizing ML techniques, due to the randomized nature. The key contributions of the work being presented in the poster are: • A novel approach for transforming a computer network to graph ne