# Malicious Traffic Detection on Tofino Using Graph Attention Model
## 3 Maltof
### RF-Based Screening Module
The updated feature vector calculation equation in a single-layer GAT is as follows:

\[a_{ij}=\frac{e^{LeakyReLU(\overrightarrow{a}^{T})[W\widehat{h}_{i}||W\widehat{ h}_{j}^{*}]}}{\sum_{k\in N_{i}}e^{LeakyReLU(\overrightarrow{a}^{T}[W \widehat{h}_{i}||W\widehat{h}_{i}]}}, \tag{2}\]

where \(||\) is the connection operation, \(N_{i}\) represents the set of sampled neighboring nodes of the target node \(i\), and \(W\) is the shared weight matrix. \(\overrightarrow{h}_{i}\) and \(\overrightarrow{h}_{j}\) are the feature vectors of node \(i\) and its neighbor node \(j\). In addition, \(\overrightarrow{a}^{T}\in R^{2F^{\prime}}\) represents the weight vector, and LeakyReLU is used as the activation function. Then, through the activation function \(\sigma\), the new feature vector \(\overrightarrow{h}_{j}^{\prime}\) of the target node \(i\) is obtained after normalization as

\[\overrightarrow{h}_{i}^{\prime}=\sigma(\sum_{j\in N_{i}}a_{ij}W\overrightarrow {h}_{j}^{\prime}). \tag{3}\]

The output node features are represented as

\[h_{i}^{\prime}=\{\overrightarrow{h}_{1}^{\prime},\overrightarrow{h}_{2}^{ \prime},...\overrightarrow{h}_{N}^{\prime}\},\overrightarrow{h}_{n}^{ \prime}\in R^{F^{\prime}}. \tag{4}\]

In order to improve the model's structural differentiation ability in node embedding, we improved the target node feature aggregation strategy and retained the original attention mechanism learning ability. [PERSON] optimizes the feature aggregation method of the target node to enhance the output effect of the new node vector feature of each network layer as

\[h_{i}^{\prime}=\sigma^{l}(\sum_{j\in N_{i}}a_{ij}^{l-1}\overrightarrow{h}_{j} ^{l-1}+\overrightarrow{h}_{j}^{l-1}). \tag{5}\]

where \(l\) represents the number of network layers, \(\sigma^{l}\) represents the nonlinear activation function of the \(l\)th layer, and \(\overrightarrow{h}_{j}^{l-1}\) represents the final result of the dot product between the features of all neighboring nodes of the target node in the \(l-1\)th layer network and the matrix \(W\). In the process of updating the node features of the next layer, the original node features \(\overrightarrow{h}_{j}^{l-1}\) are retained without weight selection. This ensures that the basic information encapsulated by the original node features can be incorporated into the training of the next layer of the network, thereby improving the performance of the model. In order to make the attention learning process more stable, the graph attention layer introduces a multi-head attention mechanism, that is, using K independent attention

Figure 3: Neighborhood feature aggregation based on GAT. mechanisms to update the node features, and then [PERSON] chooses to adopt the splicing aggregation strategy to retain the node features as

\[h_{i}^{\prime}=||_{k=1}^{K}\sigma(\sum_{j\in N_{i}}a_{ij}^{k}W^{k}\overrightarrow{h }_{j}), \tag{6}\]

where \(||\) represents concatenation, \(K\) is the number of attention heads used, \(a_{ij}^{k}\) is the attention score calculated by the \(K\) attention mechanism, and \(W^{k}\) is the \(K\) weight matrix. ## 4 Experimental Results and Analysis

### Experimental Environment

We deployed Maltof on a Barefoot Tofino switch. The switch is equipped with an Intel J1900 4-core 2.0 GHz CPU and 8 GB memory, and has a total of 54 Ethernet interfaces and 2 management interfaces. The data interfaces include 48 10 GbE (SFP+) or 25 GbE (SFP28) interfaces and 6 40 GbE (QSFP+)/100 GbE (QSFP28) interfaces. The experiment evaluates the overall performance of Maltof for real-time online malicious traffic detection. The Tofino switch is used to perform rule matching and traffic filtering in the data plane, while the CPU is responsible for further deep identification of potential malicious traffic. The experiment uses PyTorch 1.13 [26] as a deep learning framework. We use two high-performance servers as the sender and receiver. The servers are equipped with two Intel(R) Xeon(R) E5-2690 v2 CPUs (3.00 GHz, 10 cores), 64G RAM, and two 10 G Ethernet NICs, running Linux kernel 4.4.0.