IoT device fingerprinting has evolved through three stages [11,12]. Early work leveraged physical-layer characteristics such as clock skew [13] and Radio Frequency (RF) imbalances [14], but these methods are susceptible to environmental conditions and require specialized hardware. The second stage focused on plaintext protocol tokens (e.g., Dynamic Host Configuration Protocol (DHCP), HyperText Transfer Protocol (HTTP) User-Agent), exemplified by IoT Sentinel [15]. However, with TLS now encrypting over 90% of home-network traffic, plaintext-based methods have become largely ineffective [16], driving a shift toward encryption-agnostic behavioral analysis.

Current approaches analyze sequences of traffic metadata (packet size, direction, inter-arrival times) using deep learning [17]. Convolutional Neural Networks (CNNs) [18] and Long Short-Term Memory networks (LSTMs) [19] capture local temporal patterns [20,21] but struggle with long-range dependencies. Transformers improved accuracy via global self-attention, yet their O(n2) complexity precludes millisecond-level gateway deployment. Pre-training paradigms such as ET-BERT [22] and YaTC [23] further advanced the state of the art through contextualized representation learning.

To overcome the complexity bottleneck, Structured State Space models (S4 [7], H3 [24]) reduce complexity to O(n). Mamba [8] adds input-dependent selective gating for context-aware state evolution, matching Transformer quality at linear cost. Mamba-2 [25] further establishes a theoretical SSM–attention duality with 2–8× speedups. In the traffic domain, NetMamba [9] first applied Mamba to network traffic classification, raising Macro-F1 from 96.1% to 97.8% while cutting Graphics Processing Unit (GPU) memory by 40%, and ET-Mamba [26] extends the paradigm with ultra-low parameter counts. SSMs have also shown promise for traffic generation [27]. Despite these successes, existing methods flatten traffic into one-dimensional sequences, disregarding the inherent “packet-flow” hierarchy and lacking intrinsic interpretability [9]. In parallel, lightweight classification architectures have been explored for resource-constrained IoT environments, including Multi-Layer Perceptron (MLP)-based feature extractors with linear classifiers [28] and hybrid ensemble frameworks for industrial IoT intrusion detection [29]. However, these approaches do not address the hierarchical structure of traffic data or provide intrinsic explainability.

Interpretability is essential for deploying deep learning in safety-critical security scenarios [30]: Security Operations Center (SOC) analysts need to understand alert root causes [31], and regulations such as the General Data Protection Regulation (GDPR) mandate auditability. Post-hoc methods like LIME [32] and SHAP [33] rely on perturbation-based sampling whose fidelity has been questioned [10,34], while attention-based visualizations correlate poorly with model gradients [35]. Our proposed GAF overcomes these limitations by leveraging the Mamba architecture’s internal gating signals to generate fine-grained, input-aligned attributions at zero additional cost [8].

In summary, physical-layer and protocol-token methods are ineffective under encryption [3]; Transformers face quadratic complexity bottlenecks [5]; and Mamba-based models lack hierarchical modeling and interpretability [9]. Meanwhile, edge deployment demands lightweight solutions [36]. This paper addresses these gaps with a hierarchical Mamba framework and gated attribution mechanism, targeting two objectives at linear complexity: (1) modeling the “packet-flow” hierarchy, and (2) providing real-time explanations.

Conventional models flatten all packet features into a single sequence, discarding the inherent two-level structure where packets are nested within flows [9,37], inflating the sequence length to L×K and conflating intra-packet and inter-packet patterns. We instead propose a multi-level representation that explicitly preserves the packet-flow hierarchy.

A network flow is defined as a sequence of L packets:(1)Flow=(P1,P2,…,PL)

Each packet Pi is represented as a sequence of K intra-packet feature tokens. Specifically, we extract a fixed set of metadata fields from each packet header—including source port, destination port, protocol type, Transmission Control Protocol (TCP) flags, payload length, and inter-arrival time—and discretize continuous values into categorical bins. Notably, the inclusion of protocol type as an explicit input token allows the shared Packet-Mamba encoder to naturally differentiate TCP from User Datagram Protocol (UDP) semantics: because Mamba’s gating parameters (Δt, Bt, Ct) are all input-dependent (Section 3.2), the encoder implicitly conditions its behavior on the protocol context without requiring separate per-protocol branches. The tokenized representation is:(2)Pi→Spkt(i)=(tok1,tok2,…,tokK)

Each token tokj is mapped to a dense vector via a learnable embedding layer Ef:(3)Semb(i)=(Ef(tok1),Ef(tok2),…,Ef(tokK))

To preserve the ordering semantics among tokens within a packet, a learnable positional encoding PE∈RK×d is added element-wise to the embedded sequence:(4)S~emb(i)=Semb(i)+PE

The position-augmented sequence S~emb(i) serves as the input to the hierarchical encoder.

The HMX encoder employs a dual-layer stacked Mamba architecture to explicitly model the hierarchical nature of network traffic. Before describing each layer, we first review the core Selective State Space mechanism that underpins both.

Selective State Space Mechanism. Each Mamba layer is built upon a state space model that maps input xt to output yt through a latent state ht∈RN. The continuous system h′(t)=Ah(t)+Bx(t), y(t)=Ch(t) is discretized via zero-order hold with step size Δ:(5)A¯=exp⁡(ΔA),B¯=(ΔA)−1(A¯−I)⋅ΔByielding the recurrence ht=A¯ht−1+B¯xt, yt=Cht. Crucially, Mamba makes B, C, and Δ input-dependent via learned projections from xt [8]: the gate Δt modulates how strongly each token updates the hidden state, enabling the model to emphasize informative tokens while suppressing noise. This selectivity is the theoretical cornerstone upon which our GAF mechanism (Section 3.3) is built.

Packet-Mamba (Packet-Level Encoder). The first layer processes S~emb(i) to capture intra-packet token dependencies. The selective scan is applied over the K tokens, and the final hidden state serves as the context-aware packet embedding:(6)epi=PacketMamba(S~emb(i))=hK(p)

The resultant packet embedding epi∈Rd encodes rich intra-packet contextual information, such as the semantic association between TCP flags and port numbers. All L packets in a flow are processed by a shared Packet-Mamba with tied parameters, ensuring parameter efficiency. We adopt last-state extraction rather than alternative pooling (mean-pooling, attention-pooling) because Mamba’s selective scan progressively accumulates all token information into each hidden state via input-dependent gating. Unlike vanilla Recurrent Neural Networks (RNNs), Mamba’s Δt-controlled update ensures hK(p) retains full intra-packet context, making additional pooling redundant. This design choice is empirically validated in Section 4.4.

Flow-Mamba (Flow-Level Encoder). The second layer, termed Flow-Mamba, takes the sequence of packet embeddings Sf as its input to model inter-packet temporal dependencies:(7)Sf=(ep1,ep2,…,epL)

Flow-Mamba computes the final hidden state hL(f), which serves as the comprehensive embedding for the entire network flow:(8)fflow=FlowMamba(Sf)=hL(f)

Although both layers share the same mathematical formulation, they operate at different semantic granularities: the former captures field-level correlations within a packet header, while the latter captures behavioral patterns across the temporal evolution of a flow. This hierarchical design mirrors the physical generation process of network traffic, enabling more robust and semantically meaningful representations.

To achieve intrinsic explainability without post-hoc computation, GAF repurposes the selective gating signals already computed during the Mamba forward pass.

Theoretical Foundation. As shown in Eq. (5), the step size Δt controls how strongly input xt updates the hidden state. Under a first-order approximation (B¯t≈Δt⋅Bt), the state innovation scales linearly with Δt, making it a natural, gradient-aligned [35] measure of each token’s contribution. For token zt, its attribution score is:(9)𝒜(zt)=Δt

This hypothesis—that Δ serves as a high-fidelity proxy for feature importance—is empirically validated in Section 4.5 through comparison with gradient-based ground truth.

Hierarchical Attribution Pipeline. Leveraging the dual-layer HMX design, GAF enables a structured top-down attribution process across two semantic levels:

Flow-level attribution: The Δi(f) values computed by Flow-Mamba quantify the relative importance of each packet Pi to the final flow embedding fflow. These scores are normalized across the flow to produce a packet-importance distribution: (10)𝒜^flow(Pi)=Δi(f)∑j=1LΔj(f)

Composite Attribution Score. The two levels are composed multiplicatively to trace a decision down to a specific token:(12)𝒜global(tokj,Pi)=𝒜^flow(Pi)×𝒜^pkt(tokj∣Pi)

This composite score traces decisions from flow level to individual packet features at zero additional inference cost, since all Δ values are already computed during the forward pass.

The model is trained with a composite loss to jointly optimize classification accuracy and embedding space geometry (Fig. 3):(13)ℒ=ℒcls+λℒtripletwhere ℒcls denotes the standard cross-entropy loss over the device label space.

Triplet Loss and Hard Mining. The triplet loss encourages compact, well-separated clusters for each device class:(14)ℒtriplet=max(0, d(fa,fp)−d(fa,fn)+m)where d(⋅,⋅) is the Euclidean distance and m=0.2 is the margin. We employ online semi-hard negative mining to select negatives satisfying d(fa,fp)<d(fa,fn)<d(fa,fp)+m, balancing gradient strength with training stability. Concretely, within each mini-batch of 256 flows (sampled to contain at least 4 flows per device class), we form all valid anchor-positive pairs from same-class flows and search the batch for semi-hard negatives from different classes. When no semi-hard negative exists for a given pair, we fall back to the hardest negative (smallest d(fa,fn)); pairs lacking any valid negative are skipped. This yields approximately 1200 triplets per batch on average. The coefficient λ=0.1 is determined via grid search.

Anomaly Scoring. After training, a class centroid μc=1|𝒟c|∑f∈𝒟cfflow is computed for each known device class. At inference, a new flow fnew is scored by its distance to the nearest centroid:(15)AnomalyScore=‖fnew−μc∗‖2

Flows exceeding a threshold τ (calibrated on the validation set) are flagged as anomalous; GAF (Section 3.3) then identifies the responsible features. We choose Euclidean distance for its simplicity and edge efficiency; a comparison with Mahalanobis and kNN scoring is provided in Section 4.4. Note that fflow=hL(f) is the final hidden state of the Flow-Mamba recurrence, which is inherently order-sensitive: two flows with identical per-packet statistics but different temporal orderings produce distinct embeddings, ensuring that temporal dynamics are captured in the anomaly score.

Table 2 summarizes the performance comparison on the CIC-IoT-2024 test set (Fig. 4). HMX–GAF achieved a Macro-F1 of 0.992 (+0.3% over NetMamba-U) with low standard deviation (±0.002), and the highest AUC-ROC of 0.987. Under the throughput setting (FP32, batch =32) on Jetson Xavier NX, it reaches 20.1 ms per sample, maintaining competitive efficiency. The edge setting (batch = 1) is analyzed in Section 4.3 (Table 3).

Table 3 reports single-sample inference on NVIDIA Jetson Xavier NX (FP32, B = 1, 200 runs after 50 warm-ups). SSM models are consistently more efficient than Transformers. HMX–GAF lies on the Pareto frontier: while slightly slower than NetMamba-U (28.1 vs. 26.5 ms), it achieves higher Macro-F1 (0.992 vs. 0.989), offering a superior accuracy–efficiency trade-off. Tail latency (P95) is well controlled at +2–4 ms above the mean.

We conduct ablations under the same pipeline (device-disjoint split, identical preprocessing/training schedule); Table 4 reports mean ± std over five seeds. Three findings stand out: (i) Hierarchy is the dominant contributor—removing it lowers Macro-F1 by 1.4 pp and AUC by 1.2 pp; (ii) Triplet loss acts as a geometry regularizer—it brings a modest Macro-F1 gain but a larger AUC gain; (iii) GAF provides small yet consistent improvements without extra training overhead. Replacing the Flow-Mamba backbone with Transformer or Gated Recurrent Unit (GRU) further degrades both metrics, confirming the advantage of SSM-style backbones.

We further evaluate two additional design choices. First, we compare three packet aggregation strategies: Mean-Pool (epi=1K∑jhj(p)), Attention-Pool (learned weighted sum), and our default Last-State (hK(p)). As shown in the middle portion of Table 4, Last-State achieves the best Macro-F1 (0.992) with no additional parameters, confirming that the Mamba recurrence effectively accumulates full token context into its final state. Second, we compare anomaly scoring functions: Euclidean distance to the nearest centroid (default), Mahalanobis distance, and k-Nearest Neighbor (k=5) in embedding space. Mahalanobis yields a marginal AUC-ROC improvement (+0.001) at 1.12× overhead, while kNN slightly underperforms (−0.001) at 3.5–6× overhead. The Euclidean baseline thus offers the best trade-off for edge deployment.

We validate GAF through three complementary analyses.

(1) Qualitative Case Study. As illustrated in Fig. 5, GAF correctly attributed the classification of a “Google Home Mini” to Domain Name System (DNS) queries for *.google.com and subsequent QUIC bursts—a known behavioral signature. For a Mirai-infected camera, GAF identified repeated TCP connection attempts to port 23 (Telnet) as the root cause of the high anomaly score, aligning with expert domain knowledge.

(2) Perturbation Test. We injected a known irrelevant token into 10,000 flows; GAF achieved 96.2% top-1 precision in identifying it as least important (Table 5).

(3) Gradient Cross-Validation. We computed Spearman’s rank correlation between GAF scores and gradient-based importance (L2-norm of output gradients w.r.t. input embeddings) over 10,000 test samples, obtaining a mean correlation of 0.88 (σ=0.06). This confirms that GAF provides a faithful, zero-overhead alternative to expensive post-hoc gradient methods. For reference, generating SHAP explanations for a single flow requires ∼500 forward passes (∼14 s on Jetson Xavier NX), while LIME requires ∼1000 perturbation samples (∼28 s); GAF produces attributions within the same single forward pass used for classification.

Generalization. Our evaluation uses CIC-IoT-2024 (97 device types). Generalizability to enterprise or industrial IoT environments remains to be verified through cross-dataset evaluation.

Scalability. The hierarchical architecture introduces a moderate memory increase over flat models (352 vs. 286 MB on Jetson Xavier NX). Scaling to ultra-high-throughput (≥10 Gbps) core networks may require FP16/INT8 quantization. Additionally, the default truncation to L=50 packets covers 87% of flows in the CIC-IoT-2024 dataset; preliminary experiments at L∈{20,50,100,200} show diminishing returns beyond L=50 (Macro-F1: 0.984, 0.992, 0.993, 0.993), and adaptive-length processing remains a direction for future work.

Explainability Scope. GAF attributions are tied to the model’s internal Δ dynamics (cf. Section 3.2) [40]. Integrating external domain knowledge could further enhance actionability for SOC analysts.

This paper proposed HMX-GAF, a Hierarchical Mamba framework with Gated Attribution Fingerprinting for IoT traffic classification. The HMX hierarchical encoder achieves a Macro-F1 of 0.992 on CIC-IoT-2024 via dual-layer Mamba architecture; the GAF mechanism provides zero-cost attributions with 96.2% top-1 precision and 0.88 Spearman correlation with gradient-based importance; and edge evaluations on Jetson Xavier NX confirm 28.1 ms inference latency at batch size 1.

Future work will focus on: (1) cross-domain validation on heterogeneous datasets; (2) model compression via knowledge distillation and quantization-aware training; and (3) integrating GAF attributions with automated threat response systems.