# Malicious Traffic Detection on Tofino Using Graph Attention Model
## 3 Maltof
### RF-Based Screening Module
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Category Name** & **Meaning** & **Quantity** \\ \hline Normal & Normal traffic & 46,521 \\ Analysis & Attack traffic infiltrated through port scanning, emails, and web script files. & 200 \\ Backdoor & Attack traffic that bypasses security mechanisms such as identity authentication to illegally & 179 \\ DoS & Attack traffic that occupies a large amount of memory resources and makes the network unable & 505 \\  & to provide normal services. & 2474 \\ Exploits & Attack traffic that exploits security vulnerabilities in operating systems, etc. & 1948 \\ Fuzzers & Attack traffic that causes a target program to overflow by inputting random data. & 557 \\ Generic & Use hash functions to create collision attack traffic for each block cipher. & 1230 \\ Reconnaissance & Attack traffic that bypasses security mechanisms by collecting network information. & 137 \\ Shellcode & Attack traffic that allows attackers to exploit vulnerabilities and execute arbitrary instructions & 30 \\ Worms & Attack traffic that replicates itself and spreads to other target hosts. & 550 \\ Generic & Use hash functions to create collision attack traffic for each block cipher. & 550 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: NF-UNSW-NB15 dataset. ### Comparison Method

(1) CNN: CNN is a deep learning model. The convolutional neural network used in this comparative experiment consists of two convolutional modules, a fully connected layer, a dropout layer, and a Softmax layer. (2) LSTM: LSTM is a special recurrent neural network. This comparative experiment consists of an input layer, two LSTM hidden layers, and an output layer. The stacking structure enhances the learning ability of the model. (3) E-GraphSAGE [19]: The model updates the feature representation of the target node by aggregating the feature information of neighboring nodes. Specifically, it consists of two aggregation layers and an output layer, and the aggregation function used is average aggregation. A unified training protocol was adopted with a batch size of 500, 2 training epochs, cross-entropy as the loss function, and the Adam optimizer. Model-specific configurations are as follows: The CNN model consists of two convolutional modules, each comprising a convolutional layer (64 kernels of size 3 \(\times\) 3, stride 1, padding 1), a BatchNorm layer, and a ReLU activation function. The convolutional blocks are followed by a fully connected layer with 128 units, a dropout layer with a rate of 0.2, and a Softmax output layer. The learning rate is set to 0.005. The LSTM model utilizes two stacked LSTM layers (128 units per layer), with tanh as the activation function, followed by a Softmax output layer. The learning rate is set to 0.01. The E-GraphSAGE model comprises two GraphSAGE layers (each with 64 units), employing the MeanPooling aggregation function and ReLU activation. This model uses a learning rate of 0.005 and a dropout rate of 0.2 and incorporates L2 regularization with a weight decay coefficient of 1 \(\times\) 10\({}^{5}\), followed by a Softmax output layer. This section selects accuracy, precision, recall, and F1-score as the criteria for evaluating the classification effect of the model. Binary classification refers to detecting be