# Malicious Traffic Detection on Tofino Using Graph Attention Model
## 3 Maltof
### RF-Based Screening Module
\begin{table}
\begin{tabular}{p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt}} \hline \hline
**Ref** & **Method** & **Purpose** & **Task Type** & **Result** \\ \hline \multirow{4}{*}{[PERSON] et al. [28]} & \multirow{4}{*}{CNN} & \multirow{4}{*}{Generalization test for IoT traffic detection} & \multirow{4}{*}{Binary-class} & High accuracy and F1 (main dataset: F1 = 0.9952); & \\  & & & IoT traffic detection & & outperforms CNN+LSTM, DNN, etc. \\ \hline \multirow{4}{*}{[PERSON] et al. [29]} & \multirow{4}{*}{DNN} & Intrusion type classification and cross-dataset & \multirow{4}{*}{Binary-class} & \multirow{4}{*}{Outperforms baseline models on NF datasets; accuracy up to 0.99 on test set} \\  & & & & & \\ \hline \multirow{4}{*}{[PERSON] et al. [30]} & \multirow{4}{*}{Edge Attention} & Multi-class attack detection under imbalanced data & \multirow{4}{*}{Multi-class} & Accuracy = 97.87\% on NF-UNSW-NB15 \\ \cline{1-1} \cline{5-5}  & & Industrial IoT intrusion detection with feature selection & & & \\ \cline{1-1} \cline{5-5}  & & Link anomaly detection using structural and edge features & \multirow{4}{*}{Binary-class and multi-class} & Outperforms baselines on multiple datasets \\ \cline{1-1} \cline{5-5}  & & Multi-type attack detection in zero-trust networks & & & Balanced accuracy = 91.48\%, FPR = 3.34\% on NF-UNSW-NB15-v2 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Summary of NF-UNSW-NB15 usage in recent intrusion detection studies. nign/malicious attacks in RF, while multi-class classification refers to detecting whether the data packet is benign or a specific type of attack. ### RF Multi-Class Classification Results

In the first stage, Maltof embeds the RF model into the data plane of Tofino and preliminarily screens the massive network traffic through the matching-action table mechanism. Additionally, a lower threshold increases sensitivity, reducing the likelihood of false negatives but at the expense of system overhead due to more traffic being forwarded for deep analysis. Conversely, a higher threshold improves efficiency but may miss subtle malicious patterns. In our implementation, a threshold of 38 was selected to balance this trade-off, ensuring real-time processing capabilities of the P4 switch while achieving high detection accuracy (see Figure 4). Figure 4 shows the detection indicators of the binary and multi-classification tasks of the RF model on the NF-UNSW-NB15 dataset. Among them, the binary classification task refers to the ability of RF to distinguish between _normal traffic_ and _malicious traffic_, while the multi-classification task involves the ability of RF to identify whether the traffic is _normal_ or a _specific type of attack_. The results show that RF performs better in relatively simple binary classification tasks. The multi-classification confusion matrix in Figure 5 shows that the performance of the RF model is good in the binary classification task (Figure 5a) but slightly insufficient in the multi-classification task (Figure 5b), and some traffic categories are misclassified as other types of malicious packets. This reflects that RF still has room for improvement in identifying different types of attacks. However, the main goal of this stage is to use the efficiency of the RF model to quickly isolate potential malicious traffic and preliminarily screen out suspicious packets, thereby effectively reducing the burden of subsequent deep detection and ensuring the system's processing capabilities in high-throughput scenarios. Figure 4: Performance indicators of the RF model on the NF-UNSW-NB15. ### EGAT Multi-Class Classification Results

In the second stage, [PERSON] deploys a lightweight EGAT model on the switch's CPU. The confusion matrix results shown in Figure 6 show that the EGAT model significantly improves the accuracy in multi-classification tasks, especially in distinguishing specific attack types.