# Malicious Traffic Detection on Tofino Using Graph Attention Model
## 2 Background and Related Works
### P4 Programmable Switch  
The P4 switch is a programmable network device that allows users to customize the processing logic of data packets using the P4 language, and can flexibly and efficiently handle large-scale network traffic. The P4 switch is equipped with two processors. One is an embedded CPU, which can manage the local data plane; handle the compilation, debugging, and installation tasks of the P4 program; and also configure the matching rules of P4. The other processor is the Tofino ASIC, which is responsible for data plane operations and runs customized P4 programs. Its architecture includes a parser, a match-action pipeline, and an inverse parser. The main task of the parser is to parse the incoming data packets, identify the protocol stack, and extract the required data fields. In each pipeline stage, a series of structured tables and actions are defined, which together specify the processing logic of the data packet. The table presets rules that match specific data packet attributes and executes corresponding actions. The action consists of a statement block similar to a C language function, which is used to modify the data packet or related data structure in the switch memory. The inverse parser is responsible for reassembling the modified data packet and determining its transmission form in the network by repackaging, serializing, and sending the data packet.  
\begin{table}
\begin{tabular}{p{85.4 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline
**Ref** & **Model** & **Dataset** & **Contributions** \\ \hline [PERSON] et al. [17] & Learning Traffic Classifier & ISCX VPN–non-VPN & Capable of effectively filtering unknown-category traffic in real time and providing accurate labels, with support for online classifier updates. \\ \hline [PERSON] et al. [18] & GCN & Open public datasets & Extract structural features using GCN and employing an autoencoder to complement flow data representation; high classification performance can still be achieved even when labeled samples are limited. \\ \hline [PERSON] et al. [19] & NN & Real network data & Capable of capturing all intrusion samples with zero false positives; custom window-based feature extraction for critical infrastructure environments enhances detection reliability. \\ \hline This work & EGAT & NF-UNSW-NB15 & This paper proposes a malicious traffic detection architecture that collaborates with CPU and Tofino. It combines the rule-based fast pre-filtering on the Tofino side with the EGAT deep reasoning analysis on the CPU side to perform deeper feature aggregation and classification of suspicious traffic, thus achieving high-accuracy and low-latency malicious traffic detection. \\ \hline \end{tabular}
\end{table}
Table 1: _Cont._Compared with traditional systems, P4 switches can identify and respond to malicious traffic more quickly and update detection rules in real time through flexible programming, thereby quickly adapting to changing network threats [21]. Therefore, many researchers deploy machine learning algorithms on P4 switches to implement traffic detection. [PERSON] et al. [22] proposed the ML-Pushback mechanism, in which the P4 switch is responsible for collecting discarded packets and sending packet summaries to the control plane. The deep learning module on the control plane extracts signatures from the summaries and classifies them through a decision tree algorithm. If it is identified as attack traffic, the control plane limits its rate, thereby effectively mitigating the attack threat. [PERSON] et al. [23] proposed a framework for network traffic classification that can generate simple and efficient machine learning models and deploy them in programmable switches. Compared with existing complex models, the performance loss of this model is minimal while maintaining high accuracy. [PERSON] et al. [24] optimized the decision tree into a binary decision tree in Mousika and offloaded the BDT to the P4 switch for traffic analysis, thereby improving the efficiency of traffic detection.