# Malicious Traffic Detection on Tofino Using Graph Attention Model
## 3 Maltof
### RF-Based Screening Module
Currently, experiments have only been conducted on the NF-UNSW-NB15 dataset, and further validation is needed to assess generalization capabilities on other intrusion detection datasets (such as CIC-IDS2017) or real production network traffic. Additionally, a systematic evaluation of the energy consumption and switch resource usage required for the practical deployment of Maltot has not yet been performed. Future work will include energy consumption testing and cost-benefit analysis to evaluate its feasibility in operator-level networks. The large-scale imbalance of positive and negative samples in the NF-UNSW-NB15 dataset may lead to false negatives in minority classes. Future work should further reduce the risk of false negatives through methods such as weighted loss or oversampling, and continuously validate the robustness of the model in real production environments. Additionally, control charts are one of the main tools of statistical process control (SPC). They monitor the changes of process indicators in real time and identify the deviation from the \"controlled\" state to the \"out of control\" state [35; 36]. Classic methods such as Shewhart control charts, exponentially weighted moving average (EWMA), and cumulative sum (CUSUM) can achieve early detection and location of abnormal signals through continuous observation of single or multiple indicators [36]. In the field of network traffic monitoring, control chart methods have attracted the attention of researchers due to their advantages such as robustness to noise and adjustable thresholds. For multivariate control charts \begin{table}
\begin{tabular}{l l l l l} \hline
**Method** & **Accuracy** & **Precision** & **Recall** & **F1** \\ \hline CNN & 0.9751 & 0.9743 & 0.9747 & 0.9748 \\ LSTM & 0.9744 & 0.9681 & 0.9743 & 0.9712 \\ E-GraphSAGE & 0.9764 & 0.9727 & 0.9764 & 0.9746 \\ EGAT & **0.9785** & **0.9779** & **0.9785** & **0.9786** \\ \hline \end{tabular}
\end{table} 
Table 6: Comparison of multi-classification performance with other algorithms. of dynamic networks, a variety of network features are combined to achieve adaptive monitoring of various network forms by flexibly selecting parametric or non-parametric control charts, and their efficiency and reliability are verified on simulation and real datasets [37]. In addition, for network sequences with autocorrelation characteristics, the performance of different control charts is evaluated based on the separable time series exponential random graph model. This study found that the detection ability of standard Shewhart, EWMA, and CUSUM charts decreases in high autocorrelation scenarios, while the control chart based on residuals can significantly improve the anomaly detection rate [38]. In the future, we will further consider introducing SPC and control chart methods into network traffic monitoring. ## 5 Summary

This paper proposes Maltof, an intelligent network malicious traffic online detection system deployed on programmable switches, aiming to improve the accuracy and efficiency of malicious traffic detection. The system first uses the P4 programming language to integrate a rule-based RF model on the switch's Tofino chip to quickly screen potentially malicious traffic; then, it runs a lightweight EGAT model on the switch CPU to conduct in-depth analysis and detection of the filtered data packets. Through this layered detection mechanism, Maltof significantly reduces the computational burden and can quickly respond to potential threats in high-speed network environments. Experimental results show that Maltof performs well in malicious traffic detection and has broad application prospects. At the same time, Maltof still has some limitations. For example, (1) the parallel computing capability of P4 switches is weak, which can be solved by deploying GPUs on programmable switches in the future. (2) P4 programming capabilities need to be improved, and the syntax and functions are not flexible for multi-classification tasks in traffic detection.