# Malicious Traffic Detection on Tofino Using Graph Attention Model
## 2 Background and Related Works  
### Malicious Traffic Detection Based on Deep Learning  
Faced with the diversification and complexity of network attack strategies, traditional traffic detection solutions based on ports and payload have been unable to meet current security needs [12]. Therefore, more and more researchers have begun to introduce deep learning (DL) [13] into network security protection systems, and the analysis results are presented in Table 1. As a major milestone in the development of artificial intelligence, deep learning has achieved remarkable results in fields such as pattern recognition, automatic translation, and network security. Its ability to automatically extract features gives it strong adaptability in processing complex data. [PERSON] et al. [14] proposed a method of converting traffic data into images using CNN, and used the concept of images to classify and identify malware traffic. Subsequently, [PERSON] et al. [15] proposed an end-to-end traffic classification model based on a one-dimensional convolutional neural network, which can efficiently handle encryption protocol classification problems and achieve excellent accuracy. [PERSON] et al. [16] proposed a new network traffic classifier (NTC) technology that combines RNN and CNN to effectively improve the detection efficiency of network services such as HTTP and DNS without the need for complex feature engineering. [PERSON] et al. [17] proposed an autonomous update framework for deep learning traffic identification models, which integrates three stages: packet classification, autonomous identification of unknown applications, and automatic marking of unknown packets to achieve efficient updates, providing a dynamic update mechanism for traffic detection.  
\begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline
**Ref** & **Model** & **Dataset** & **Contributions** \\ \hline [PERSON] et al. [14] & CNN & - & First-time application of representation learning methods to malicious traffic classification shows experimental results that meet the accuracy requirements for real-world applications. \\ \hline [PERSON] et al. [15] & CNN & ISCX VPN–non-VPN & Automatically extract nonlinear features using E2E approach; in four experiments, 11 out of 12 evaluation metrics outperformed existing methods. \\ \hline [PERSON] et al. [16] & CNN + RNN & IoT network traffic & No feature engineering is required, and CNN is naturally extended to traffic classification. \\ \hline \end{tabular}
\end{table}
Table 1: Contributions of main malicious traffic detection based on DLHowever, most current deep learning models process conventional Euclidean data, such as network traffic in the form of images or sequences, which can only capture its spatial and temporal characteristics and ignore the correlation between data, resulting in low detection rate and high false alarm rate. The graph neural network (GNN) [20], as an advanced graph representation of deep learning technology, has shown significant advantages in mining graph-structured data and identifying malicious traffic, thanks to its ability to integrate the structure of node information and attribute information. In recent years, [PERSON] et al. [18] proposed a method that combines statistical features in traffic tracking graphs and graph convolutional network (GCN) models, which can achieve performance improvements with fewer labels. [PERSON] et al. [19] developed the E-GraphSAGE algorithm, which is used for IoT intrusion detection by capturing edge features and topological structures of graphs. Experimental results show that this method outperforms existing methods on multiple NIDS benchmark datasets, verifying the potential of GNN in network intrusion detection.