Research on a Network Traffic Intrusion Detection System Based on MAMBA-KAN

We present a framework for network traffic intrusion detection that integrates the selective state-space model (Mamba) with the Kolmogorov - Arnold Network (KAN). This framework addresses major IDS challenges: spatiotemporal feature coupling, high-dimensional sparsity, and computational inefficiency. First, we review IDS method evolution: from traditional machine learning and deep neural networks, through pretrained Transformers, to state-space models with learnable activation-function classifiers. The proposed Mamba-KAN model adopts a “pretrain-and-finetune” paradigm. It leverages Mamba's selective state-space mechanism to model long-term attack patterns in linear time. It also uses KAN's learnable activation functions to adaptively fit nonlinear feature boundaries, reducing dependence on labeled data. Extensive comparative and ablation studies on four public datasets (CIC-IDS2017, CIC-IoT2022, USTC-TFC2016, and CrossPlatform-Android) show that our model significantly outperforms both traditional machine learning and leading deep-learning baselines in F1 score and other key metrics. It also exhibits strong robustness and generalization, particularly in detecting minority-class attacks. This study not only offers a lightweight, efficient solution for large-scale real-time traffic monitoring but also paves the way for deep integration of state-space models with learnable spline mappings. Future work will focus on incorporating additional adversarial attacks and cross-domain evaluations to test model robustness, as well as exploring activation visualization and model-pruning strategies to improve deployment efficiency and decision transparency, thereby advancing the practical deployment of industrial-grade IDS.