We present MambaNetBurst, a compact tokenizer-free byte-level sequence classifier for network burst classification based on a Mamba-2 backbone. In contrast to most recent strong traffic-classification and intrusion-detection approaches, our method operates directly on raw packet bytes, avoids tokenization, patching, and heavy engineered multimodal representations, and does not require any self-supervised pre-training stage. Given a packet flow, we form a fixed-length burst from the first few packets, embed the resulting byte sequence appending a learnable CLS token, and process it with a stack of residual pre-normalized Mamba-2 blocks for end-to-end supervised classification. Across six public benchmarks spanning encrypted mobile app identification, VPN/Tor traffic classification, malware traffic classification, and IoT attack traffic, MambaNetBurst achieves consistently strong results and is competitive with, or outperforms, substantially heavier and often pre-trained baselines. Our ablation study shows that preserving byte-level temporal resolution is critical, that early downsampling through striding is consistently harmful, and that moderate state sizes are sufficient for robust generalization. We further show that Mamba-2, despite its more constrained transition structure relative to Mamba-1, remains highly effective for packet-byte modeling while providing clear efficiency advantages, particularly in training speed. Overall, our results demonstrate that direct **undiluted** byte-to-classification learning with compact selective state space models is a practical, effective and novel direction for efficient, deployable traffic analysis that bypasses the complexity of pre-training pipelines even over highly optimized linear attention architectures.

翻译：我们提出了MambaNetBurst，这是一种基于Mamba-2骨干网络的紧凑型无分词器字节级序列分类器，专用于网络突发流分类。与近期大多数强大的流量分类和入侵检测方法不同，我们的方法直接对原始数据包字节进行操作，避免了分词、分块处理以及复杂工程化的多模态表示，且无需任何自监督预训练阶段。对于给定的数据包流，我们从前几个数据包中提取固定长度的突发序列，嵌入该字节序列并附加一个可学习的CLS标记，然后通过堆叠的残差预归一化Mamba-2模块进行处理，以实现端到端的监督分类。在涵盖加密移动应用识别、VPN/Tor流量分类、恶意软件流量分类以及物联网攻击流量的六个公开基准测试中，MambaNetBurst取得了持续优异的结果，与体积更大且通常经过预训练的基线方法相比具有竞争力，甚至表现更优。我们的消融研究表明，保持字节级时间分辨率至关重要，通过步长进行早期下采样始终有害，而适中的状态大小足以实现稳健的泛化。我们进一步证明，尽管Mamba-2与Mamba-1相比具有更受限的转移结构，但其在数据包字节建模方面仍然高效，同时提供了明显的效率优势，尤其是在训练速度上。总体而言，我们的结果表明，使用紧凑型选择性状态空间模型进行直接的、**未稀释的**字节到分类学习，是一种实用、有效且新颖的方向，可绕过预训练管线的复杂性，实现高效、可部署的流量分析，即使针对高度优化的线性注意力架构也是如此。