# Malicious Traffic Detection on Tofino Using Graph Attention Model
## 3 Maltof
### RF-Based Screening Module
Specifically, the EGAT model can accurately classify complex attack types (such as Exploit, Reconnaissance, and Shellcode), reflecting its high robustness and adaptability in complex network environments. In addition, the ROC curve [34] in Figure 7 further verifies the excellent performance of the EGAT model. In various types of attack detection, the AUC value of the EGAT model is close to 1.0. Especially when detecting normal traffic, exploit and reconnaissance attacks, the AUC value is as high as 0.99, indicating that the model has extremely low false-positive and false-negative rates in practical applications, and [PERSON] has a strong discriminative

Figure 5: Confusion matrix of the RF model. Note: The horizontal axis represents the category predicted by the model, and the vertical axis represents the actual category. The depth of the color block reflects the number of categories after normalization. The darker the main diagonal line, the higher the proportion of the corresponding category being correctly classified. (**a**) Binary classification task; (**b**) multi-classification task. Figure 6: Confusion matrix of the EGAT model in the multi-classification task. ability in distinguishing normal traffic from attacks; that is, it can achieve an almost zero false-positive rate and an almost one recall rate simultaneously. This two-stage detection mechanism shows excellent performance in real-time detection of network traffic. It can not only meet the needs of high throughput, but also provide high-precision attack detection capabilities, which is very suitable for network security scenarios that require real-time response. According to the multi-classification comparison results in Table 6 and Figure 8, the EGAT model performs better than other models (such as CNN, LSTM, and E-GraphSAGE) in terms of detection performance. Specifically, the EGAT model achieved the highest scores on all evaluation metrics, with an accuracy of 0.9785 and precision, recall, and F1 scores of 0.9779, 0.9785, and 0.9786, respectively. Figure 8: Comparison of multi-classification F1 values on the NF-UNSW-NB15 dataset. Figure 7: ROC curve of the EGAT model. In addition, Figure 8 shows that the EGAT model maintains good performance in various attack detection tasks. Especially in the detection of complex attack types (such as Shellcode, Worms, and Dos), the F1 score of the EGAT model is significantly higher than that other models. It further shows that it is more robust and adaptable in multi-type attack detection. The average training time per epoch is approximately 282.5 s. Each epoch processed around 108 batches (batch size = 500). The average processing time per batch is about 2.62 s, and the average training time per sample is approximately 5.25 ms.

### Discussion

In the experimental results, Maltot achieves a higher multi-classification F1 score on the NF-UNSW-NB15 dataset compared with CNN, LSTM, and E-GraphSAGE, as shown in Figure 8. The embedded attention mechanism in Maltot effectively weights network traffic features, enhancing its ability to capture complex patterns. Unlike traditional LSTM, which can only extract temporal features in a unidirectional manner, Maltot leverages the parallel computing advantages provided by deep programmable hardware on the Tofino switch to achieve lower latency and higher throughput, thereby improving real-time detection performance. E-GraphSAGE, while having advantages in graph structure feature extraction, suffers from latency bottlenecks in practical deployment due to the lack of direct adaptation to network hardware (such as Barefoot Tofino). Maltot fully utilizes the enhanced capabilities of the data plane through the P4 language, combining GNNs with DL frameworks. This approach retains the advantages of GNNs in topological learning while achieving line-rate forwarding-level anomaly detection.