Binning Encoder-Based Grouped Aggregation for Network Traffic Anomaly Detection
摘要
Network traffic anomaly detection remains a challenging task due to complex feature semantics and severe data imbalance. While Graph Neural Networks (GNNs) have shown strong potential in modeling network traffic, most existing approaches rely on raw features that fail to capture semantic relationships, particularly under graph heterophily, resulting in the loss of critical contextual information. Moreover, in highly imbalanced scenarios dominated by benign flows, conventional aggregation mechanisms tend to be biased toward the majority class, obscuring anomalous patterns and impairing detection performance. To overcome these limitations, we propose Binning Encoder-based Grouped Aggregation (BEGA), a novel GNN framework for network anomaly detection. First, a decision tree-based binning encoder transforms edge features into more discriminative and semantically meaningful representations, enhancing expressiveness in heterophilic graphs. Second, we introduce an edge-aware grouped aggregation mechanism that incorporates edge attributes during message passing and dynamically clusters neighboring edges by their predicted class for separate aggregation. This design strengthens the representation of minority-class (anomalous) flows, which are often suppressed by dominant traffic signals. Experimental results on four real-world NetFlow datasets show that BEGA consistently outperforms baselines across multiple datasets. These findings demonstrate that BEGA effectively addresses graph heterophily by preserving semantic diversity, and alleviates class imbalance by enabling both majority and minority classes to retain discriminative features. Our code will be publicly available at https://github.com/lingyaoluu/BEGA .