Due to the high sparsity and complexity of network traffic, the detection effect of existing network traffic anomaly detection methods was still very limited, and it was difficult to effectively utilize the topological information and traffic characteristics in the network. To solve this problem, a sampling optimization method based on the graph neural network E-GraphSAGE that combines graph topology optimization and random walk restart algorithm was proposed, which effectively utilized network topology and traffic characteristics for network traffic anomaly detection. The graph topology optimization strategy improved the performance of the graph by transforming the graph structure, so that the RWR algorithm could be used for sampling more effectively, and then the sampling results were aggregated to obtain the final edge features for training and detection models. Experiments on three common network anomaly traffic datasets was conducted. The experimental results showed that the recall rate, precision, and F1 score of the proposed method on all datasets exceeded 99%. In particular, on the ISCXTor2016 dataset, not only the evaluation indicators had reached the most advanced level, but also the recall rate, precision, and F1 score of the proposed method had been improved by 19%, 17%, and 19% respectively compared with the most advanced graph neural network model. The experimental results prove the effectiveness and robustness of the proposed method for network traffic anomaly detection tasks.