# Malicious Traffic Detection on Tofino Using Graph Attention Model
## 3 Maltof
### RF-Based Screening Module  
In this module, the RF-based screening process is carried out on the P4 switch. The module uses a series of decision tables, where each table represents an individual decision tree from the random forest model. The packet features, such as IP protocol type, TCP flags, and flow duration, are used as inputs to match the predefined rules in these tables. When a packet meets the criteria for a rule, the vote_increment action is triggered, incrementing the vote count for the respective tree and updating meta.vote_count. This process is performed iteratively across all the decision trees, accumulating votes that indicate whether the packet exhibits characteristics of potentially malicious behavior. After processing all the trees, the total meta.vote_count is compared against a predefined threshold. If the vote count exceeds this threshold, the packet is considered suspicious and is sent to the CPU for further analysis via the clone_to_cpu action. If the threshold is not exceeded, the packet is marked as benign and allowed to proceed without additional scrutiny, as shown in Algorithm 1. ```
Input: Feature set of the packet: \(F=f_{1},f_{2},\ldots,f_{n}\); random forest model parameters, including the threshold \(THRESHOLD\); predefined feature matching rules: \(R\); number of trees: \(T\). Output: Whether the packet is marked as suspicious or benign. 1 FunctionScreening()
2 Initialize meta.vote_count = 0;
3 fort = 1 : Tdo
4 iffeature \(F[t]\) matches the rule \(R\)then
5 Perform vote_increment operation;
6 Update meta.vote_count;
7
8 else
9 Perform set_benign operation;
10 Mark the packet as benign;
11
12
13 ifmeta.vote_count > THRESHOLDthen
14 Perform clone_to_cpu operation; Clone the packet to the CPU;
15
16 else
17 Perform set_benign operation;
18 Mark the packet as benign;
19

### Deep Detection Module

In this module, there are three functions, namely, sliding window management, traffic trajectory map construction, and EGAT. #### 3.4.1 Sliding Window Management

This Algorithm 2 describes the sliding window management and data preparation process in the deep detection module. The deep detection module first uses the sliding window mechanism to dynamically manage the incoming buffered packets. The code starts with initializing an empty sliding_window (line 2), and then adjusts the window_size in real time according to the network load to ensure a balance between data input and processing capacity (line 3). For each incoming packet p, it is added to the sliding_window (line 5), and if the window size exceeds the currently set window_size, the oldest packet is deleted to prevent overflow (lines 6-7). This mechanism helps avoid buffer overflow when the incoming traffic rate exceeds the processing speed, thereby preventing data loss. After managing the packet flow, all packets in the sliding window are forwarded to the EGAT module for further deep detection (line 10). The EGAT deep learning model runs in parallel on multiple CPU cores to analyze whether there are potential threats in the batch data, thereby improving the detection performance and efficiency of the system. ```
Input: Buffered packets: \(P=p_{1}\), \(p_{2}\),..., \(p_{n}\); real-time network load for window adjustment. Output: Whether the packets should be processed by the EGAT module for further detection. 1 FunctionDetection()
2 Initialize sliding_window = empty;
3 Adjust window_size based on network load;
4 foreachpacketp inPdo
5 Addp to sliding_window;
6 ifsliding_window.size >window_sizethen
7 Remove the oldest packet from sliding_window;
8 Send all packets in sliding_window to the EGAT module for further detection;
```

**Algorithm 2**Deep Detection Algorithm

#### 3.4.2 Traffic Trajectory Map Construction

During the sliding window management process, the system dynamically manages and caches filtered data packets to process network traffic more efficiently.