Sovereign Byte Firewall — Mamba-2 backbone
A 301K-parameter Mamba-2 selective state space model trained to predict raw network traffic one byte at a time. Anomalies are scored by surprise — how improbable each byte is given the bytes before it — with no attack labels used in training.
📄 Paper: 10.5281/zenodo.21546151 💻 Code: github.com/TheSPST/sovereign-byte-firewall (MIT)
⚠️ Pin the revision — this matters here
This repository has multiple commits that replace the same filename with different weights, and the earlier commit messages contain performance figures that do not reproduce. Independent re-evaluation of an earlier revision returned 0.2% false-positive rate and 12.5% detection where its commit message claimed 0.000% and 28.4%.
Use revision f05de8b (current main) and verify the hash:
from huggingface_hub import hf_hub_download
import hashlib
p = hf_hub_download(repo_id="spst01/sovereign-byte-firewall-mamba2",
filename="checkpoints/ckpt_mamba2.pt",
revision="f05de8b", local_dir="ckpt_mamba2")
h = hashlib.sha256(open(p, 'rb').read()).hexdigest()
assert h.startswith('a07e59a356b13c69'), f'unexpected weights: {h[:16]}'
The figures below were measured from exactly these bytes.
Verified results
Trained on benign traffic only (Monday-WorkingHours.pcap, CIC-IDS2017). Scored
on a held-out split of 34,043 benign and 7,572 zero-day attack windows,
neither used for training or calibration. Calibrated against 24 attack families.
Window length 512 bytes, top-10% surprise aggregation.
| Threshold rule | Calibration TPR | Held-out benign FPR | Held-out zero-day detection |
|---|---|---|---|
| Youden | 91.0% | 2.1% | 33.2% |
| Target 1% FPR | 63.5% | 0.1% | 14.3% |
| EVT / Peak-Over-Threshold | — | 0.1% | 14.1% |
Calibration ROC-AUC: 0.9601.
Honest comparison against the Transformer
Under identical calibration and the same held-out split, the 528K-parameter Transformer detects 15.0% at 0.038% FPR versus this model's 14.1% at 0.1% — slightly better detection at roughly a third of the false-alarm rate. The Youden row above looks stronger (33.2%) only because it buys detection with a 2.1% false-positive rate, far outside any workable alert budget.
Replacing self-attention with a state space backbone did not improve detection on this data. Its advantage is architectural: comparable detection at ~57% of the parameter count, linear-time O(T) processing, constant-memory streaming, and no positional-embedding table. That is an efficiency result, not an accuracy one.
Note also that this model's much higher calibration AUC (0.9601 vs 0.7962) does not translate into better deployed performance — one of several cases in this project where AUC ranked models opposite to their real behaviour.
Caveat
Training runs in this project suffered repeated collapse past the learning-rate peak, and the training loop lacked gradient clipping when this checkpoint was produced. It is plausible that a properly-stabilised Mamba-2 run would perform better than reported here. Treat this as a data point, not a verdict on the architecture.
Usage
pip install torch scapy huggingface_hub
# optional: pip install mamba-ssm (CUDA fast path; a pure-PyTorch fallback is
# used automatically when absent)
git clone https://github.com/TheSPST/sovereign-byte-firewall.git
cd sovereign-byte-firewall
python evaluate_zero_day.py \
--ckpt ckpt_mamba2/checkpoints/ckpt_mamba2.pt \
--pcap <benign_calibration.pcap> \
--benign_holdout_pcap <benign_holdout.pcap> \
--attack_dir <dir of 24 attack pcaps> \
--holdout_attack_pcap <held_out_attack.pcap> \
--score_agg topk --topk_frac 0.1 --max_sequence_length 512
--max_sequence_length 512 is required. Mamba-2 carries no positional-embedding
table, so the harness cannot infer the scoring window from the state dict and falls
back to 8192 — which exhausts GPU memory and produces numbers not comparable to the
Transformer. The backbone itself is auto-detected from the state dict; no flag needed.
Architecture
2 stacked Mamba-2 blocks, d_model=128, d_state=64, expand=2, headdim=64,
256-way next-byte output. ~301K parameters. No positional embeddings — position is
carried implicitly by the recurrence.
Input masking is identical to the Transformer variant: MAC/IP addresses, ports, checksums, and always-encrypted payloads are zeroed before scoring.
Intended use and limitations
Same envelope as the Transformer variant: a passive, offline, complementary layer for novel payloads. Not a replacement for signature IDS or EDR. Blind to content inside established encryption. Evadable by a patient sub-threshold attacker. Detects structural, not semantic, anomalies. Per-window recall is modest; campaign-level detection is higher.
See LIMITATIONS.md.
Training data
CIC-IDS2017 Monday-WorkingHours.pcap — benign traffic only.
Sharafaldin, I., Habibi Lashkari, A., Ghorbani, A. A. (2018). Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. ICISSP 2018, 108–116.
Citation
@misc{tomar2026sovereign,
author = {Tomar, Shubham},
title = {Sovereign Byte Firewall: Comparing Transformer and Mamba-2 Backbones
for Tokenization-Free Zero-Day Network Anomaly Detection},
year = {2026},
publisher = {Zenodo},
doi = {10.5281/zenodo.21546151}
}