# Malicious Traffic Detection on Tofino Using Graph Attention Model
## 3 Maltof
### RF-Based Screening Module
In order to achieve accurate traffic detection, the EGAT module designed in this paper uses the switch's CPU to calculate complex traffic-level features, such as the sum of packet lengths, traffic duration, and total bytes. This model groups the data packets after preliminary screening by random forest into four-tuple groups and organizes them into a traffic trajectory graph, converting the traffic characteristics originally represented by edges (as shown in Figure 2a) into nodes. Malicious traffic is detected through node embedding technology, and the detection task is finally transformed into a node classification problem (as shown in Figure 2b), where nodes represent edges in the original traffic graph, and edges represent IP-port combination relationships. Such a design significantly improves detection efficiency and accuracy. Among them, \(S\) represents Source, which represents the sender in the network; \(D\) represents Destination, which represents the receiver in the network; and 1, 2, 3, 4, a, b, c, and d correspond to the 8 IP-port pairs in the network. When converting, the connecting edges between the nodes in Figure 2a are used as nodes in the right figure. For example, 1a represents the edge between node 1 and node a in Figure 2a, which will connect the two nodes to the same node. The edges are connected in Figure 2b. For example, both edges 1b and 4b include node b, so 1b and 4b are connected in Figure 2b. #### 3.4.3 EGAT Module

The EGAT module employs a pre-sampling strategy to enhance the performance of the attack detection model in complex network environments. Specifically, the neighborhood of a given node is uniformly sampled with a fixed number of neighbors, where the neighborhood is defined as the set of source and destination nodes. By uniformly sampling this fixed-size neighborhood, the number of sampled neighbors for each node remains consistent, facilitating batch formation and enabling efficient batch training on the CPU. This approach ensures more structured data handling, improving both training efficiency and model scalability. The input of the GAT aggregation layer consists of the F-dimensional feature representation of the sampled nodes, denoted as \(h=\{\overrightarrow{h}_{1}\), \(\overrightarrow{h}_{2}\),... \(\overrightarrow{h}_{N}\)}, \(\overrightarrow{h}_{n}\in R^{F}\), where \(N\) represents the number of nodes in a batch and \(F\) corresponds to the feature count of a single node. The output of all node features is denoted as \(h=\{\overrightarrow{h}_{1}\), \(\overrightarrow{h}_{2}\),... \(\overrightarrow{h}_{N}\)}, \(\overrightarrow{h}_{n}\in R^{F^{\prime}}\). In this process, a learnable linear transformation \(W\) is required to achieve feature enhancement and transform the input features into high-level features. Figure 3 shows the core aggregation mechanism of GAT. For node \(i\), the following equation calculates the attention correlation coefficient \(e_{ij}\) between all its neighbor nodes \(j\) and it, as follows:

\[e_{ij}=a([Wh_{i}||Wh_{j}]),j\in N_{i}, \tag{1}\]

where \(e_{ij}\) represents the importance of neighbor node \(j\) to target node \(i\); \([\bullet||\bullet]\) represents adding \(Wh_{i}\) and \(Wh_{j}\) together; \(a\) is a \(2F^{\prime}\) weight vector of the hidden layer, where \(W\in R^{F^{\prime}F}\) is the shared weight matrix; \(F\) and \(F^{\prime}\) are the number of features of the input and output layers of the network layer, respectively; and the weight matrix establishes the mapping relationship between these two parameters. Figure 2: The construction of a traffic trajectory map. In order to compare coefficients between different nodes, the attention coefficients of all neighboring nodes are normalized using the Softmax function and used as feature weights. Then, the new node features are calculated by weighted summing of neighboring nodes.