A Multi-Feature Domain Interaction Learning Framework for Anomalous Network Detection

Network anomaly detection aims to identify abnormal traffic patterns that may indicate faults or cyber threats. This task requires modeling complex network flows composed of heterogeneous features, such as static headers, packet sequences, and statistical summaries. However, most existing methods focus on temporal modeling and treat flows as uniform sequences, overlooking feature heterogeneity and dependencies across domains. As a result, they often miss subtle anomalies that can be reflected by cross-domain correlations, highlighting the need for more structured modeling. We propose a domain-aware framework for network anomaly detection that explicitly models the heterogeneity of flow-level features and their cross-domain interactions. To address the limitations of prior work in handling heterogeneous flow features, we design an Intra-Domain Expert Network (IDEN) that uses convolutional and feed-forward layers to independently extract patterns from distinct domains. We further introduce an Inter-Domain Expert Network (EDEN) that uses attention mechanisms to capture dependencies across domains and produces integrated flow representations. These refined representations are passed to a Transformer-based temporal module to detect anomalies over time, including gradually evolving or coordinated behaviors. Experiments on multiple public datasets show that our method achieves higher detection accuracy, demonstrating the value of explicitly modeling intra-domain structure and inter-domain dependencies.