Detecting anomalies on network traffic is a complex task due to the massive amount of traffic flows in today's networks, as well as the highly-dynamic nature of traffic over time. In this paper, we propose the use of Graph Neural Networks (GNN) for network traffic anomaly detection. We formulate the problem as contextual anomaly detection on network traffic measurements, and propose a custom GNN-based solution that detects traffic anomalies on origin-destination flows. In our evaluation, we use real-world data from Abilene (6 months), and make a comparison with other widely used methods for the same task (PCA, EWMA, RNN). The results show that the anomalies detected by our solution are quite complementary to those captured by the baselines (with a max. of 36.33% overlapping anomalies for PCA). Moreover, we manually inspect the anomalies detected by our method, and find that a large portion of them can be visually validated by a network expert (64% with high confidence, 18% with mid confidence, 18% normal traffic). Lastly, we analyze the characteristics of the anomalies through two paradigmatic cases that are quite representative of the bulk of anomalies.

翻译：网络流量中的异常检测是一项复杂任务，原因在于当今网络中流量规模庞大，且流量随时间具有高度动态特性。本文提出采用图神经网络（GNN）进行网络流量异常检测。我们将该问题建模为网络流量测量数据上的上下文异常检测，并设计了一种基于GNN的定制化解决方案，用于检测源-目的流中的流量异常。在评估中，我们使用来自Abilene网络（6个月）的真实数据，并与广泛使用的同类方法（PCA、EWMA、RNN）进行对比。结果表明，我们的方法检测到的异常与基线方法捕获的异常具有显著互补性（与PCA的重叠异常最高为36.33%）。此外，通过对检测到的异常进行人工分析发现，大部分异常可由网络专家通过视觉验证（64%高置信度、18%中等置信度、18%为正常流量）。最后，我们通过两个具有代表性的典型案例分析了异常的特征。