The rapid growth of malicious activities on the Internet is severely impacting the security of the Internet infrastructure. As a prevention strategy, many malware traffic detection methods are proposed to classify malicious behaviors through the analysis of traffic characteristics. However, the rising encryption techniques render some traffic characteristics unavailable, posing significant obstacles to the classification of malware traffic. This significantly diminishes the effectiveness of existing malware traffic detection methods that depend on a single type of attribute. In this paper, we propose Mal-GAT, a malware traffic classification method based on Graph Attention Networks (GAT). In addition to the conventional flow attributes, Mal-GAT explores the local and global features of network behaviors reflected in the graph connectivity structure present in traffic and integrates all available information to enhance the detection of malware traffic. Initially, Mal-GAT constructs malware traffic behavior graphs through packet-level and flow-level analysis of raw network traffic data. Subsequently, it integrates graph neural networks and attention mechanisms to automatically extract local node features and global graph structure features from the traffic behavior graph. Extensive experimental results on multiple datasets demonstrate that Mal-GAT achieves high accuracy in malware traffic classification.