Detecting anomalies on network traffic is a complex task due to the massive
amount of traffic flows in today's networks, as well as the highly-dynamic
nature of traffic over time. In this paper, we propose the use of Graph Neural
Networks (GNN) for network traffic anomaly detection. We formulate the problem
as contextual anomaly detection on network traffic measurements, and propose a
custom GNN-based solution that detects traffic anomalies on origin-destination
flows. In our evaluation, we use real-world data from Abilene (6 months), and
make a comparison with other widely used methods for the same task (PCA, EWMA,
RNN). The results show that the anomalies detected by our solution are quite
complementary to those captured by the baselines (with a max. of 36.33%
overlapping anomalies for PCA). Moreover, we manually inspect the anomalies
detected by our method, and find that a large portion of them can be visually
validated by a network expert (64% with high confidence, 18% with mid
confidence, 18% normal traffic). Lastly, we analyze the characteristics of the
anomalies through two paradigmatic cases that are quite representative of the
bulk of anomalies.

利用图神经网络（GNN）检测网络流量异常