MambaNetBurst: Direct Byte-level Network Traffic Classification without Tokenization or Pretraining

• URL: http://arxiv.org/abs/2605.11034v1
• Date: Mon, 11 May 2026 02:01:26 GMT
• Title: MambaNetBurst: Direct Byte-level Network Traffic Classification without Tokenization or Pretraining
• Abstract summary: MambaNetBurst is a compact tokenizer-free byte-level sequence classifier for network burst classification based on a Mamba-2 backbone.<n>Our method operates directly on raw packet bytes, avoids tokenization, patching, and heavy engineered multimodal representations.<n>MambaNetBurst achieves consistently strong results and is competitive with, or outperforms, substantially heavier and often pre-trained baselines.
• Score: 12.060053394320725
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: We present MambaNetBurst, a compact tokenizer-free byte-level sequence classifier for network burst classification based on a Mamba-2 backbone. In contrast to most recent strong traffic-classification and intrusion-detection approaches, our method operates directly on raw packet bytes, avoids tokenization, patching, and heavy engineered multimodal representations, and does not require any self-supervised pre-training stage. Given a packet flow, we form a fixed-length burst from the first few packets, embed the resulting byte sequence appending a learnable CLS token, and process it with a stack of residual pre-normalized Mamba-2 blocks for end-to-end supervised classification. Across six public benchmarks spanning encrypted mobile app identification, VPN/Tor traffic classification, malware traffic classification, and IoT attack traffic, MambaNetBurst achieves consistently strong results and is competitive with, or outperforms, substantially heavier and often pre-trained baselines. Our ablation study shows that preserving byte-level temporal resolution is critical, that early downsampling through striding is consistently harmful, and that moderate state sizes are sufficient for robust generalization. We further show that Mamba-2, despite its more constrained transition structure relative to Mamba-1, remains highly effective for packet-byte modeling while providing clear efficiency advantages, particularly in training speed. Overall, our results demonstrate that direct **undiluted** byte-to-classification learning with compact selective state space models is a practical, effective and novel direction for efficient, deployable traffic analysis that bypasses the complexity of pre-training pipelines even over highly optimized linear attention architectures.

Related papers

• CRISP: Cliff-awaRe Input-adaptive Sparse Prefilling with Structural-Mass-Motivated Routing [90.63350360476294]
  We present CRISP (Cliff-awaRe Input-adaptive Sparse Prefilling), which identifies and addresses two structural challenges in this dynamic routing paradigm.<n>We show that the routing decision can be read directly off the structure of the proxy attention map.<n>We formalize the post-softmax mass cliff and demonstrate theoretically that strictly cumulative coverage thresholds accumulate O(n) background noise at long contexts.
  arXiv  Detail & Related papers  (2026-09-01T22:49:46Z)
• ActiveFlowMark: Assessing Tor Anonymity under Active Bandwidth Watermarking [34.15634406550005]
  Low-latency anonymity networks such as Tor remain vulnerable to infrastructure-level traffic analysis.<n>We introduce NATA, a non-invasive active traffic-correlation analysis algorithm.<n>It injects distinguishable throughput patterns into traffic flows through controlled bandwidth perturbations.
  arXiv  Detail & Related papers  (2026-05-07T08:57:57Z)
• Stateful Token Reduction for Long-Video Hybrid VLMs [69.6930118088911]
  We study query-conditioned token reduction for hybrid video vision-language models (VLMs)<n>We propose a low-to-high progressive reduction schedule and a unified language-aware scoring mechanism for both attention and Mamba blocks.<n>Under an aggressive compression setting, our approach delivers substantial prefilling speedups with near-baseline accuracy at test time.
  arXiv  Detail & Related papers  (2026-02-27T08:11:06Z)
• PACC: Protocol-Aware Cross-Layer Compression for Compact Network Traffic Representation [10.787806670196938]
  PACC is a redundancy-aware, layer-aware representation framework.<n>It consistently outperforms feature-engineered and raw-bit baselines.<n>It improves end-to-end efficiency by up to 3.16x.
  arXiv  Detail & Related papers  (2026-02-09T07:09:31Z)
• U-Mamba2-SSL for Semi-Supervised Tooth and Pulp Segmentation in CBCT [44.3806898357896]
  We propose U-Mamba2-SSL, a novel semi-supervised learning framework that builds on the U-Mamba2 model and employs a multi-stage training strategy.<n>U-Mamba2-SSL achieved an average score of 0.789 and a DSC of 0.917 on the hidden test set, achieving first place in Task 1 of the STSR 2025 challenge.
  arXiv  Detail & Related papers  (2025-09-24T14:19:33Z)
• Convolutions are Competitive with Transformers for Encrypted Traffic Classification with Pre-training [12.150588010496165]
  We investigate whether convolutions, with linear complexity and implicit positional encoding, are competitive with Transformers in encrypted traffic classification with pre-training.<n>We propose NetConv, a novel pre-trained convolution model for encrypted traffic classification.<n>We show that NetConv improves average classification performance by 6.88% and model throughput by 7.41X over existing pre-trained models.
  arXiv  Detail & Related papers  (2025-08-04T02:42:44Z)
• MIETT: Multi-Instance Encrypted Traffic Transformer for Encrypted Traffic Classification [59.96233305733875]
  Classifying traffic is essential for detecting security threats and optimizing network management.<n>We propose a Multi-Instance Encrypted Traffic Transformer (MIETT) to capture both token-level and packet-level relationships.<n>MIETT achieves results across five datasets, demonstrating its effectiveness in classifying encrypted traffic and understanding complex network behaviors.
  arXiv  Detail & Related papers  (2024-12-19T12:52:53Z)
• SIGMA: Selective Gated Mamba for Sequential Recommendation [56.85338055215429]
  Mamba, a recent advancement, has exhibited exceptional performance in time series prediction.<n>We introduce a new framework named Selective Gated Mamba ( SIGMA) for Sequential Recommendation.<n>Our results indicate that SIGMA outperforms current models on five real-world datasets.
  arXiv  Detail & Related papers  (2024-08-21T09:12:59Z)
• NetMamba: Efficient Network Traffic Classification via Pre-training Unidirectional Mamba [14.02833253204577]
  Network traffic classification is a crucial research area aiming to enhance service quality, streamline network management, and bolster cybersecurity. Existing approaches face two main challenges. Firstly, they struggle with model inefficiency due to the quadratic complexity of the widely used Transformer architecture. We propose NetMamba, an efficient linear-time state space model equipped with a comprehensive traffic representation scheme.
  arXiv  Detail & Related papers  (2024-05-19T04:58:53Z)
• One Train for Two Tasks: An Encrypted Traffic Classification Framework Using Supervised Contrastive Learning [18.63871240173137]
  We propose an effective model named a Contrastive Learning Enhanced Temporal Fusion (CLE-TFE) In particular, we utilize supervised contrastive learning to enhance the packet-level and flow-level representations. We also propose cross-level multi-task learning, which simultaneously accomplishes the packet-level and flow-level classification tasks in the same model with one training.
  arXiv  Detail & Related papers  (2024-02-12T09:10:09Z)
• Distributed Adversarial Training to Robustify Deep Neural Networks at Scale [100.19539096465101]
  Current deep neural networks (DNNs) are vulnerable to adversarial attacks, where adversarial perturbations to the inputs can change or manipulate classification. To defend against such attacks, an effective approach, known as adversarial training (AT), has been shown to mitigate robust training. We propose a large-batch adversarial training framework implemented over multiple machines.
  arXiv  Detail & Related papers  (2022-06-13T15:39:43Z)
• The Devil is in the Boundary: Exploiting Boundary Representation for Basis-based Instance Segmentation [85.153426159438]
  We propose Basis based Instance(B2Inst) to learn a global boundary representation that can complement existing global-mask-based methods. Our B2Inst leads to consistent improvements and accurately parses out the instance boundaries in a scene.
  arXiv  Detail & Related papers  (2020-11-26T11:26:06Z)
• Improving Semantic Segmentation via Self-Training [75.07114899941095]
  We show that we can obtain state-of-the-art results using a semi-supervised approach, specifically a self-training paradigm. We first train a teacher model on labeled data, and then generate pseudo labels on a large set of unlabeled data. Our robust training framework can digest human-annotated and pseudo labels jointly and achieve top performances on Cityscapes, CamVid and KITTI datasets.
  arXiv  Detail & Related papers  (2020-04-30T17:09:17Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.