MambaNetBurst: Byte-Level Network Traffic Classifier without Tokenization

Researchers have introduced MambaNetBurst, a compact byte-level sequence classifier that does not require tokenization for classifying network bursts, utilizing a Mamba-2 backbone. This approach differs from recent techniques in traffic classification and intrusion detection by processing raw packet bytes directly, eliminating the need for tokenization, patching, or complex multimodal representations, and it does not necessitate self-supervised pre-training. A fixed-length burst is created from the initial packets of each flow, embedding the byte sequence with a learnable CLS token, which is then processed through pre-normalized Mamba-2 blocks for supervised classification. MambaNetBurst demonstrates consistently strong performance across six public benchmarks, including encrypted mobile app identification and IoT attack traffic, often surpassing significant baselines.