Design of Network Anomaly Detection Model Based on Graph Representation Learning

Network attacks are becoming increasingly diverse and sophisticated, resulting in complex cybersecurity challenges, which can be fundamentally viewed as a disruption of the symmetry or balanced state in normal network behavior. To address these challenges, graph representation learning methods have gained prominence in network anomaly detection. These methods effectively represent complex network traffic data as graphs and capture data relationships. By integrating deep learning, graph neural networks, and other techniques, graph representation learning enhances the accuracy and efficiency of network anomaly detection in complex network environments. This paper proposes a novel network anomaly detection model based on graph representation learning called ETG-EESAGE. The model constructs an event key time subgraph (ETG) to group similar data and enhance structural features. Then, it introduces an edge enhancement sampling aggregation algorithm (EESAGE) to capture node relations and differentiate edge information accurately. The model generates richer node feature representations during aggregation and detects abnormal nodes using a threshold. Experimental evaluations on the CIC-IDS2017 dataset demonstrate the strong performance of the proposed model across multiple daily subsets. Under optimal configuration settings, ETG-EESAGE achieves an average accuracy of 95.5%, precision of 97.9%, recall of 97.3%, and F1-score of 97.7%, outperforming other baseline algorithms. The model also exhibits strong interpretability and applicability in real-world network anomaly detection scenarios.