# Malicious Traffic Detection on Tofino Using Graph Attention Model
## 1 Introduction  
With the rapid development of computer networks and communication technologies, the scale of networks and the number of network applications are growing exponentially [1]. At the same time, malicious attacks targeting the Internet are becoming increasingly frequent, posing serious threats to socio-economic development and national security. Therefore, leveraging technological methods to monitor network conditions, detect malicious traffic attacks early, and respond promptly can significantly enhance network resilience and defense capabilities, playing a crucial role in maintaining cybersecurity [2]. Malicious traffic detection technologies are designed to classify network traffic at multiple scales, identifying malicious attacks. Early malicious traffic detection methodsprimarily relied on port identification [3] and Deep Packet Inspection (DPI) [4], but they faced challenges in handling encrypted traffic and complex data [5]. Traditional machine learning algorithms have partially overcome the limitations of port-based and DPI methods; however, their effectiveness in traffic detection remains heavily dependent on feature engineering, making it difficult to adapt to emerging and dynamic attack patterns. In contrast, deep learning-based approaches provide a new direction for malicious traffic detection by directly feeding pre-processed data into neural networks for training, significantly reducing the reliance on manual feature extraction. Currently, the most widely used deep learning algorithms for this purpose include convolutional neural networks (CNNs) [6], long short-term memory (LSTM) [7], and deep belief networks (DBNs) [8]. These methods offer promising solutions to address the evolving challenges in malicious traffic detection [9]. The emergence of programmable switches has introduced new approaches to malicious traffic detection. Programmable switches, which allow users to customize packet processing logic through programming languages, can handle large-scale network data streams [10]. These switches typically integrate two types of chips: CPU and ASIC [11]. The CPU acts as a local control unit responsible for managing high-level network logic, such as loading configurations, issuing rules, and interacting with network applications. In contrast, the ASIC (such as Tofino) serves as the core of the data plane, enabling ultra-fast packet processing and forwarding, thus executing customized traffic handling tasks. P4 programmable switches use the P4 language to define their data forwarding behavior, allowing for programmable control of the ASIC chip and flexible packet processing. When detecting novel attacks or malicious traffic patterns, P4 switches can quickly update rules to implement custom traffic filtering and classification. More complex analysis and detection tasks, such as running graph neural network models, can be offloaded to the upper-layer CPU processors. This architecture maintains efficient traffic processing while enhancing the accuracy of malicious traffic detection. Therefore, this paper proposes a malicious traffic detection method, Maltof, deployed on the P4 programmable switch, aiming to improve the accuracy and efficiency of real-time malicious traffic detection. Specifically, Maltof embeds a rule-based random forest (RF) model into the Tofino data plane of the switch through the P4 programming language, quickly matching traffic features with preset rules to efficiently screen out potential malicious traffic. This preliminary screening can reduce the amount of data analyzed and reduce the computational burden of network devices. Then, Maltof deploys the lightweight Edge-based Graph Attention Network (EGAT) model proposed in this paper on the CPU of the switch. The model conducts in-depth analysis of the suspicious data packets screened in the previous stage, learns the complex correlation features in the network traffic, and further verifies whether it is malicious traffic.