# NetMamba: Efficient Network Traffic Classification via Pre-training Unidirectional Mamba

arXiv: https://arxiv.org/abs/2405.11449 · HTML: https://mlsanity.com/paper/2405.11449/

## Key facts

- Cited by 24 papers in the map (data through 14 Oct 2026).
- Placed in Video, motion and generative Mamba models, one of 10 directions in State-space sequence models (S4, Mamba).
- Builds on 22 of its 41 references that are in the map.
- First posted on arXiv 19 May 2024.

## Placed in

- State-space sequence models (S4, Mamba) / [Video, motion and generative Mamba models](https://mlsanity.com/ssm/video-motion-and-generative-mamba-models/)

## Builds on (most cited first, 22 of 22)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale](https://mlsanity.com/paper/2010.11929/) (2020)
- [Masked Autoencoders Are Scalable Vision Learners](https://mlsanity.com/paper/2111.06377/) (2021)
- [Mamba: Linear-Time Sequence Modeling with Selective State Spaces](https://mlsanity.com/paper/2312.00752/) (2023)
- [Transformers are RNNs: Fast Autoregressive Transformers with Linear Attention](https://mlsanity.com/paper/2006.16236/) (2020)
- [Vision Mamba: Efficient Visual Representation Learning with Bidirectional State Space Model](https://mlsanity.com/paper/2401.09417/) (2024)
- [VMamba: Visual State Space Model](https://mlsanity.com/paper/2401.10166/) (2024)
- [PointMamba: A Simple State Space Model for Point Cloud Analysis](https://mlsanity.com/paper/2402.10739/) (2024)
- [Graph-Mamba: Towards Long-Range Graph Sequence Modeling with Selective State Spaces](https://mlsanity.com/paper/2402.00789/) (2024)
- [VL-Mamba: Exploring State Space Models for Multimodal Learning](https://mlsanity.com/paper/2403.13600/) (2024)
- [Deep Packet: A Novel Approach For Encrypted Traffic Classification Using Deep Learning](https://mlsanity.com/paper/1709.02656/) (2017)
- [ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification](https://mlsanity.com/paper/2202.06335/) (2022)
- [MiM-ISTD: Mamba-in-Mamba for Efficient Infrared Small Target Detection](https://mlsanity.com/paper/2403.02148/) (2024)
- [k-fingerprinting: a Robust Scalable Website Fingerprinting Technique](https://mlsanity.com/paper/1509.00789/) (2015)
- [NetGPT: Generative Pretrained Transformer for Network Traffic](https://mlsanity.com/paper/2304.09513/) (2023)
- [STG-Mamba: Spatial-Temporal Graph Learning via Selective State Space Model](https://mlsanity.com/paper/2403.12418/) (2024)
- [DenseMamba: State Space Models with Dense Hidden Connection for Efficient Large Language Models](https://mlsanity.com/paper/2403.00818/) (2024)
- [Realtime Robust Malicious Traffic Detection via Frequency Domain Analysis](https://mlsanity.com/paper/2106.14707/) (2021)
- [TrafficGPT: Breaking the Token Barrier for Efficient Long Traffic Analysis and Generation](https://mlsanity.com/paper/2403.05822/) (2024)
- [TFE-GNN: A Temporal Fusion Encoder Using Graph Neural Networks for Fine-grained Encrypted Traffic Classification](https://mlsanity.com/paper/2307.16713/) (2023)
- [Lens: A Knowledge-Guided Foundation Model for Network Traffic](https://mlsanity.com/paper/2402.03646/) (2024)

## Built on by (most cited first, 24 of 24)

- [Mapping the Landscape of Generative AI in Network Monitoring and Management](https://mlsanity.com/paper/2502.08576/) (2025)
- [Network Anomaly Traffic Detection via Multi-view Feature Fusion](https://mlsanity.com/paper/2409.08020/) (2024)
- [Pegasus: A Universal Framework for Scalable Deep Learning Inference on the Dataplane](https://mlsanity.com/paper/2506.05779/) (2025)
- [Demystifying Network Foundation Models](https://mlsanity.com/paper/2509.23089/) (2025)
- [PLUME: Building a Network-Native Foundation Model for Wireless Traces via Protocol-Aware Tokenization](https://mlsanity.com/paper/2603.13647/) (2026)
- [CENTILE: A Telemetry Foundation Model Evaluated by the Decisions It Drives](https://mlsanity.com/paper/2608.01725/) (2026)
- [Venturing into Uncharted Waters: The Navigation Compass from Transformer to Mamba](https://mlsanity.com/paper/2406.16722/) (2024)
- [Bias in the Shadows: Explore Shortcuts in Encrypted Network Traffic Classification](https://mlsanity.com/paper/2601.10180/) (2026)
- [Mean Masked Autoencoder with Flow-Mixing for Encrypted Traffic Classification](https://mlsanity.com/paper/2603.29537/) (2026)
- [UniAlign: A Model-Agnostic Framework for Robust Network Traffic Classification under Distribution Shifts](https://mlsanity.com/paper/2605.17575/) (2026)
- [SoK: Where Do Flow Labels Come From? Auditing Label Provenance in Encrypted Traffic Benchmarks](https://mlsanity.com/paper/2609.02140/) (2026)
- [Inference-to-complete: A High-performance and Programmable Data-plane Co-processor for Neural-network-driven Traffic Analysis](https://mlsanity.com/paper/2411.00408/) (2024)
- [Versatile yet Efficient Network Traffic Analysis: Offloading Network Foundation Model to SmartNIC](https://mlsanity.com/paper/2508.02001/) (2025)
- [Generalizable IoT Traffic Representations for Cross-Network Device Identification](https://mlsanity.com/paper/2601.19315/) (2026)
- [Where Do Flow Semantics Reside? A Protocol-Native Tabular Pretraining Paradigm for Encrypted Traffic Classification](https://mlsanity.com/paper/2603.10051/) (2026)
- [Multimodal Reasoning with LLM for Encrypted Traffic Interpretation: A Benchmark](https://mlsanity.com/paper/2604.08140/) (2026)
- [MambaNetBurst: Direct Byte-level Network Traffic Classification without Tokenization or Pretraining](https://mlsanity.com/paper/2605.11034/) (2026)
- [TraceCodec: A Compiler-Backed Neural Codec for Network Traffic Traces](https://mlsanity.com/paper/2605.29941/) (2026)
- [GETA: Generalized Encrypted Traffic Analysis](https://mlsanity.com/paper/2605.31277/) (2026)
- [Protocol-Aware Tokenization and Architecture Co-Design for Wireless Packet Foundation Models](https://mlsanity.com/paper/2606.20587/) (2026)
- [Disentangling Multi-View Scanning in Mamba for Network Traffic Anomaly Detection](https://mlsanity.com/paper/2607.22829/) (2026)
- [PERO: Efficient Robust Post-Training Foundation Models for Encrypted Traffic Classification](https://mlsanity.com/paper/2608.15504/) (2026)
- [TDDM-Melatt: A Decoupled Memory and Diffusion Framework for Generalizable Encrypted Traffic Classification](https://mlsanity.com/paper/2608.30745/) (2026)
- [Beyond Measurement Metrics: A Human-Centered Framework for Semantic Validation of Network Traffic Classification](https://mlsanity.com/paper/2609.17014/) (2026)

## Abstract (arXiv)

Network traffic classification is a crucial research area aiming to enhance service quality, streamline network management, and bolster cybersecurity. To address the growing complexity of transmission encryption techniques, various machine learning and deep learning methods have been proposed. However, existing approaches face two main challenges. Firstly, they struggle with model inefficiency due to the quadratic complexity of the widely used Transformer architecture. Secondly, they suffer from inadequate traffic representation because of discarding important byte information while retaining unwanted biases. To address these challenges, we propose NetMamba, an efficient linear-time state space model equipped with a comprehensive traffic representation scheme. We adopt a specially selected and improved unidirectional Mamba architecture for the networking field, instead of the Transformer, to address efficiency issues. In addition, we design a traffic representation scheme to extract valid information from massive traffic data while removing biased information. Evaluation experiments on six public datasets encompassing three main classification tasks showcase NetMamba's superior classification performance compared to state-of-the-art baselines. It achieves an accuracy rate of nearly 99% (some over 99%) in all tasks. Additionally, NetMamba demonstrates excellent efficiency, improving inference speed by up to 60 times while maintaining comparably low memory usage. Furthermore, NetMamba exhibits superior few-shot learning abilities, achieving better classification performance with fewer labeled data. To the best of our knowledge, NetMamba is the first model to tailor the Mamba architecture for networking.