NetMamba+: A Framework of Pre-trained Models for Efficient and Accurate Network Traffic Classification

2026-01-29

AI Summary

This work addresses the challenges posed by the rapid growth of encrypted network traffic, where existing methods struggle with classification efficiency, preservation of byte-level features, and handling long-tailed label distributions. To overcome these limitations, we propose NetMamba+, a novel framework that introduces the Mamba architecture to network traffic classification for the first time. NetMamba+ integrates Flash Attention, designs a multimodal unbiased traffic representation, and incorporates a label distribution-aware fine-tuning strategy to enhance performance in few-shot and long-tailed scenarios. Experimental results demonstrate that our approach achieves up to a 6.44% improvement in F1 score across four benchmark tasks, delivers 1.7× higher inference throughput than baseline models with reduced memory consumption, and attains an online classification throughput of 261.87 Mb/s.

Technology Category

• Machine Learning: Multi-class/Multi-label Learning & Extreme Classification
• Computer Vision: Large Vision Models
• Natural Language Processing: Safety and Robustness

Application Category

• Responsible Web: Measurement, analysis, and circumvention of Web censorship
• Web Mining and Content Analysis: Large pretrained models with web data
• Security and Privacy: Large-scale security measurements

Abstract

With the rapid growth of encrypted network traffic, effective traffic classification has become essential for network security and quality of service management. Current machine learning and deep learning approaches for traffic classification face three critical challenges: computational inefficiency of Transformer architectures, inadequate traffic representations with loss of crucial byte-level features while retaining detrimental biases, and poor handling of long-tail distributions in real-world data. We propose NetMamba+, a framework that addresses these challenges through three key innovations: (1) an efficient architecture considering Mamba and Flash Attention mechanisms, (2) a multimodal traffic representation scheme that preserves essential traffic information while eliminating biases, and (3) a label distribution-aware fine-tuning strategy. Evaluation experiments on massive datasets encompassing four main classification tasks showcase NetMamba+'s superior classification performance compared to state-of-the-art baselines, with improvements of up to 6.44\% in F1 score. Moreover, NetMamba+ demonstrates excellent efficiency, achieving 1.7x higher inference throughput than the best baseline while maintaining comparably low memory usage. Furthermore, NetMamba+ exhibits superior few-shot learning abilities, achieving better classification performance with fewer labeled data. Additionally, we implement an online traffic classification system that demonstrates robust real-world performance with a throughput of 261.87 Mb/s. As the first framework to adapt Mamba architecture for network traffic classification, NetMamba+ opens new possibilities for efficient and accurate traffic analysis in complex network environments.

Problem

• network traffic classification
• computational inefficiency
• traffic representation
• long-tail distribution
• encrypted traffic

Innovation

• Mamba architecture
• multimodal traffic representation
• label distribution-aware fine-tuning
• efficient traffic classification
• few-shot learning