# Malicious Traffic Detection on Tofino Using Graph Attention Model
## 3 Maltof
### RF-Based Screening Module
We use packETH to simulate network traffic. The all-traffic dataset is divided into 70% training set and 30% test set, with a batch size of 500, and the model is trained for 2 epochs. Additionally, Maltof uses a 3-layer EGAT, each layer contains 6 attention heads, and the hidden layer size is 64. Table 2 shows other model parameter settings. ### Experimental Dataset

We evaluate the performance of the online classification of NF-UNSW-NB15 data on the P4 switch. NF-UNSW-NB15 (The dataset is available at [[https://staff.itee.uq.edu.au/marius/NIDS_datasets/](https://staff.itee.uq.edu.au/marius/NIDS_datasets/)]([https://staff.itee.uq.edu.au/marius/NIDS_datasets/](https://staff.itee.uq.edu.au/marius/NIDS_datasets/)), accessed on 23 June 2025). [27] is a new variant of the original UNSW-NB15 dataset from PCAP format to NetFlow format. The benefits of using NetFlow as a common format include its practicality, widespread deployment in production networks, and scalability. The total number of NF-UNSW-NB15 data flows is 1,623,118, \begin{table}
\begin{tabular}{l l} \hline \hline
**Experimental Platform** & **Setting** \\ \hline
**Parameters of Algorithm 1.** & \\ n\_estimators & 64 \\ max\_depth & 4 \\ max\_features & sqrt \\ min\_samples\_split & 2 \\ min\_samples\_leaf & 1 \\ bootstrap & True \\ THRESHOLD & 38 \\ \hline
**Parameters of Algorithm 2.** & \\ Activation function & eLU \\ Loss function & Cross-entropy \\ Optimization algorithm & Adam \\ Number of training rounds & Epoch = 2 \\ Batch size & Batch\_size = 500 \\ Learning rate & Lr = 0.007 \\ Dropout & 0.2 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Model parameter settings. of which 72,406 (4.46%) are malicious attack samples and 1,550,712 (95.54%) are benign samples. The dataset is also class-imbalanced, and normal traffic is downsampled. Table 3 shows the description of the NF-UNSW-NB15 dataset, and Table 4 presents the details of each flow data. The NF-UNSW-NB15 dataset has become a benchmark in network intrusion research due to its comprehensive representation of real-world traffic patterns and diverse attack scenarios. By incorporating a wide range of contemporary attack vectors alongside normal background traffic, NF-UNSW-NB15 offers researchers a balanced and high-fidelity platform for training and evaluating machine learning-based detection models. As shown in Table 5, numerous recent studies have successfully leveraged NF-UNSW-NB15 to validate both deep learning and graph-based intrusion detection approaches, demonstrating its robustness and extensibility across different methodologies. In our work, we similarly adopt NF-UNSW-NB15 to ensure that our proposed model is tested against a realistic and challenging traffic environment, thereby providing a fair basis for comparison with existing techniques and confirming the dataset's continued relevance to modern cybersecurity problems. \begin{table}
\begin{tabular}{l l} \hline \hline
**Name** & **Description** \\ \hline SRC\_ADDR & The source IP address for the data flow. \\ SRC\_PORT & The source port. \\ DST\_ADDR & The destination IP address for the data flow. \\ DST\_PORT & The destination port. \\ PROTOCOL & The transport-layer protocol. \\ PROTO & The application-layer protocol. \\ IN\_BYTES & The total number of incoming bytes from the source. \\ OUT\_BYTES & The total number of outgoing bytes to the destination. \\ IN\_PKTS & The total number of incoming packets from the source. \\ OUT\_PKTS & The total number of outgoing packets to the destination. \\ TCP\_FLAGS & TCP control flags set on the connection to track flow state. \\ MILLISECONDS & The total duration of the flow, measured in milliseconds. \\ Label & A label describing whether the flow is normal or suspicious. \\ Attack & Indicator specifying if the flow is part of an attack scenario. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Details of flows within NF-UNSW-NB15.