💻 computer science

MambaNetBurst: Direct Byte-level Network Traffic Classification without Tokenization or Pretraining

MambaNetBurst is a compact, tokenizer-free network traffic classifier that leverages a Mamba-2 backbone to perform end-to-end supervised classification directly on raw packet bytes, achieving competitive performance across diverse benchmarks without requiring tokenization, patching, or self-supervised pretraining.

Original authors: Gayan K. Kulatilleke, Siamak Layeghy, Mahsa Baktashmotlagh, Marius Portmann

Published 2026-05-13

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Gayan K. Kulatilleke, Siamak Layeghy, Mahsa Baktashmotlagh, Marius Portmann

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a security guard at a busy airport trying to figure out what kind of traveler is walking through the door.

The Old Way (The "Summarizer" Approach)
Most modern security systems try to be efficient by taking a long, detailed report of a traveler's journey and summarizing it. They might say, "This person walked 500 steps, wore a blue shirt, and carried a red bag." They throw away the specific details of how they walked or the exact texture of the fabric to save time. In the world of computer networks, this is called tokenization or patching. They chop up the raw data (the "bytes") into chunks, summarize them, and then feed that summary into a massive, expensive AI model.

Furthermore, these models usually need a "training camp" first. Before they can classify traffic, they have to spend weeks reading millions of network logs without any answers, trying to guess patterns on their own (this is called pre-training). Only after this expensive, time-consuming camp do they get to do the actual job of spotting hackers or identifying apps.

The New Way: MambaNetBurst
The paper introduces MambaNetBurst, a new security guard that does things differently. Instead of summarizing the traveler, it looks at the raw, unedited video feed of the traveler's first few steps.

Here is the simple breakdown of how it works and why it's special:

1. No Summaries, Just Raw Bytes

Imagine you are trying to identify a song. The old way might be to listen to a 10-second clip and say, "It sounds like rock." MambaNetBurst listens to the exact, raw sound waves of the first few seconds.

The Claim: The authors found that you don't need to chop up the data or summarize it. By feeding the AI the raw "bytes" (the 0s and 1s) directly, it can spot tiny, crucial details—like a specific pattern in a header or a tiny glitch in the payload—that get lost when you summarize the data.
The Analogy: It's like reading a book. The old way reads a "book report" written by someone else. MambaNetBurst reads the actual words on the page.

2. No "Training Camp" Needed

Most AI models for network security are like students who need to study for years before taking the final exam. They read millions of books (pre-training) to learn the language of the internet.

The Claim: MambaNetBurst skips the study camp entirely. It goes straight to the final exam. It learns to classify traffic directly by looking at examples with the answers already provided (supervised learning).
The Result: This saves a massive amount of time and computing power. You don't need a supercomputer to train it; a standard graphics card is enough.

3. The "Mamba-2" Engine

The brain of this system is a new type of AI architecture called Mamba-2.

The Old Engine (Transformers): Think of this as a librarian who has to read every single book in the library to find one specific sentence. It's powerful but gets very slow and expensive as the library (data) gets bigger.
The Mamba-1 Engine: This was a faster librarian who could scan books linearly.
The Mamba-2 Engine: This is the librarian's super-efficient cousin. It uses a clever trick (called "Structured State Space Duality") to process information incredibly fast, like a high-speed conveyor belt.
- The Catch: Mamba-2 is slightly more "rigid" in how it processes information compared to its flexible older brother (Mamba-1).
- The Surprise: The paper found that for network traffic, this rigidity is actually a good thing. It acts like a strict teacher that prevents the AI from getting confused by noise. It's simpler, faster, and just as accurate.

4. The "Burst" Strategy

The system doesn't try to analyze the entire lifetime of a connection (which could be hours long). Instead, it looks at a "burst"—just the first few packets of data (like the first 5 seconds of a conversation).

The Finding: It turns out that the most important clues about what an app is doing (or if it's malware) happen right at the very beginning. By focusing on this short, high-resolution window, the model stays fast and accurate.

The Big Takeaways

The authors tested this on six different real-world challenges, from identifying encrypted mobile apps to spotting Tor traffic and malware. Here is what they discovered:

Don't blur the picture: If you try to "downsample" (blur) the data to make it smaller, the AI gets much worse at its job. You need the high-definition, raw details.
Small is beautiful: You don't need a giant, deep brain. A compact, shallow model works perfectly fine.
Speed vs. Smarts: Mamba-2 is not only faster to train (up to 60% faster than the older version) but also uses less memory. It hits the "sweet spot" where it is both smart and efficient.
No Pre-training: The most surprising result is that you do not need the expensive, pre-training phase that everyone else uses. You can just train the model directly on the task, and it works just as well as the heavy, pre-trained giants.

In a Nutshell:
MambaNetBurst is like a security guard who doesn't need a degree, doesn't need to read a library of books first, and doesn't need to summarize the evidence. It just looks at the raw, high-definition footage of the first few seconds of a network connection and instantly knows what's going on. It's faster, cheaper, and surprisingly more accurate than the complex systems currently in use.

Technical Summary: MambaNetBurst

Problem Statement

Network traffic classification and intrusion detection are critical for cybersecurity, yet state-of-the-art approaches often rely on complex, resource-intensive pipelines. Current dominant methods typically involve:

Heavy Pre-training: Utilizing self-supervised objectives (e.g., Masked Language Modeling, Next-Token Prediction) on massive datasets before fine-tuning, which is costly and time-consuming.
Early Aggregation: To handle long input sequences efficiently, existing models often apply tokenization, patching, or striding. This downsampling can dilute fine-grained byte-level structural information (e.g., protocol headers, payload signatures) essential for accurate threat detection.
Architectural Inefficiency: Transformer-based architectures, while powerful, suffer from quadratic attention complexity or require heavy feed-forward layers even with linear attention variants, making them computationally expensive for raw byte sequences.

The paper posits that these complexities may be unnecessary. It questions whether direct modeling of raw packet bytes can eliminate the need for pre-training, engineered representations, or early downsampling, particularly when leveraging efficient State Space Models (SSMs).

Methodology: MambaNetBurst

The authors propose MambaNetBurst, a compact, tokenizer-free, byte-level sequence classifier built on a Mamba-2 backbone. The architecture operates as follows:

Input Construction: The model processes network flows by selecting the first $n$ packets (default $n=5$ ). From each packet, the first $m$ bytes (default $m=320$ ) are retained, forming a fixed-length burst of 1600 bytes. This preserves packet boundaries and focuses on informative headers and initial payloads.
Tokenizer-Free Embedding: Unlike methods that map bytes to subword tokens, MambaNetBurst maps raw byte values (0–255) directly to learnable embedding vectors ( $d_{model}=256$ ). A lightweight two-layer MLP projects these embeddings to enrich local features before sequence modeling.
Sequence Modeling: The byte sequence, appended with a learnable [CLS] token and positional embeddings, is processed by a stack of residual pre-normalized Mamba-2 blocks.
- Mamba-2 Specifics: The model utilizes Structured State Space Duality (SSD), reformulating the core computation into GEMM-friendly operations. Crucially, Mamba-2 employs a constrained transition matrix ( $A = \alpha I$ , scalar times identity) rather than the flexible diagonal matrix used in Mamba-1.
Classification: The final hidden state of the [CLS] token is passed through a linear layer and softmax for end-to-end supervised classification.
No Pre-training: The model is trained purely via supervised cross-entropy loss, bypassing any self-supervised pre-training stage.

Key Contributions

First Direct Byte-to-Classification Mamba-2: MambaNetBurst is the first work to apply Mamba-2 directly to raw network packet bytes for traffic classification without tokenization, patching, or pre-training.
Validation of Constrained Dynamics: The paper demonstrates that Mamba-2's restricted transition structure (scalar $\times$ identity) is not only sufficient for packet-byte modeling but acts as a beneficial regularizer, improving consistency across datasets compared to the more flexible Mamba-1.
Elimination of Pre-training: The study proves that discriminative traffic representations can be learned directly from raw bytes in a fully supervised setting, removing the need for the costly two-stage (pre-train + fine-tune) pipelines dominant in the literature.
Comprehensive Ablation: The authors provide extensive analysis on embedding strategies, positional encoding, striding, model depth, and state sizes, revealing that preserving byte-level temporal resolution is critical and that moderate state sizes ( $d_{state}=16-64$ ) are sufficient.

Experimental Results

The model was evaluated on six public benchmarks covering encrypted mobile app identification, VPN/Tor traffic, malware classification, and IoT attacks.

Performance: MambaNetBurst achieved consistently strong results, often outperforming or matching significantly heavier, pre-trained baselines (e.g., ET-BERT, YaTC, NetMamba).
- On ISCXTor2016, it achieved a macro-F1 of 0.9990, surpassing NetMamba (0.9986) and ET-BERT (0.9967).
- On USTC-TFC2016 (Malware), it reached 0.9954 macro-F1, outperforming NetMamba (0.9957) and ET-BERT (0.9910).
- On CrossPlatform (Android/iOS), it achieved macro-F1 scores of 0.9824 and 0.9851 respectively, competitive with or superior to pre-trained Transformers.
Efficiency:
- Training Speed: Mamba-2 demonstrated a 30–60% speedup in backward passes compared to Mamba-1 and significantly faster inference than Linear Transformers with FlashAttention-2.
- Memory: It utilized 2–4 $\times$ less GPU memory than Transformer variants, enabling larger batch sizes on commodity hardware (e.g., RTX 3090).
Ablation Insights:
- Striding is Harmful: Early downsampling (striding) caused the most significant performance degradation, confirming that fine-grained byte order is critical.
- Mamba-2 vs. Mamba-1: Mamba-2 showed better mean performance and lower variance across datasets, suggesting its constraints act as an implicit regularizer.
- Depth and Size: Moderate depth (4 layers) and state sizes (16–64) were sufficient; increasing state size to 128 degraded performance, indicating that massive latent memory is unnecessary for this modality.

Significance and Claims

The paper claims that MambaNetBurst establishes a new, practical paradigm for network traffic analysis:

Feasibility of Direct Learning: It challenges the assumption that expensive pre-training pipelines are necessary for state-of-the-art traffic classification. Direct, undiluted byte-to-classification learning with compact SSMs is shown to be highly effective.
Efficiency and Deployability: By avoiding pre-training and leveraging Mamba-2's hardware efficiency, the approach offers a simpler, faster, and more deployable solution, particularly for resource-constrained environments or scenarios requiring frequent retraining (e.g., NIDS).
Robustness of Byte-Level Modeling: The results suggest that preserving the native resolution of packet bytes is more important than maximizing the flexibility of the latent dynamical system or aggregating data early.

The authors conclude that this work opens promising directions for byte-level SSMs in cybersecurity, offering a simpler alternative to the complex, pre-training-heavy pipelines that currently dominate the field.