Explainable Hierarchical Mamba for Edge-Based IoT Traffic Classification

With the proliferation of Internet of Things (IoT) devices, accurate device fingerprinting of highly encrypted traffic has emerged as a critical challenge for ensuring network security. Existing deep learning models are either difficult to deploy in real-time due to excessive computational complexity (e.g., Transformers) or are limited in performance because their structure does not match the inherent hierarchy of traffic data (e.g., flattened state space models). Furthermore, a general lack of transparency in their decision-making processes restricts their trustworthiness in security-critical scenarios. To address these challenges, this paper proposes a Hierarchical Mamba with Gated Attribution Fingerprinting (HMX-GAF) framework. The framework explicitly models the intrinsic hierarchical structure of traffic data via a bespoke packet-flow dual-layer Mamba encoder, resolving the issue of architectural mismatch. Concurrently, it pioneers a zero-overhead Gated Attribution Fingerprinting (GAF) mechanism by leveraging the internal gating signals of the Mamba model, achieving high-fidelity intrinsic explainability. Comprehensive experiments on the CIC-IoT-2024 dataset demonstrate that HMX-GAF significantly outperforms current state-of-the-art models in both device identification and anomaly detection tasks, while maintaining the millisecond-level inference efficiency required for edge deployment.