Anomaly Detection in Network Traffic via Cross-Domain Federated Graph Representation Learning

With the growing complexity and frequency of network threats, anomaly detection in network traffic has become a vital task for ensuring cybersecurity. Traditional detection approaches typically rely on statistical features while overlooking the interaction patterns and structural dependencies among traffic flows. In addition, network traffic data are distributed across heterogeneous devices and domains, where centralized training methods face significant challenges such as data leakage and data silos. To address these issues, we propose a network traffic anomaly detection method based on cross-domain federated graph representation learning. In this method, network traffic is modeled as a graph, and a feature-structure decoupling design is adopted to separate the encoding and learning of graph topology and node attributes. Only structural information with minimal sensitive content is transmitted to the central server, whereas sensitive node attributes are preserved and processed locally to enhance privacy protection. Furthermore, a cross-gated feature fusion mechanism is introduced to enhance the expressive interaction between features and to generate graph-level embeddings for anomaly classification. To further improve the model’s generalization across domains, a cross-domain structural guidance mechanism is implemented on the server side, which integrates structural information from multiple domains to guide the training of local models. Comparative experiments with other methods demonstrate that the proposed approach achieves superior performance in distributed network traffic anomaly detection scenarios.