Toward a Comparative Analysis of State Space Models and Transformers for Network Anomaly Detection under Varying Context Lengths

Anomaly detection in network traffic requires processing long time series, which makes Transformers less suitable for such tasks due to their quadratic complexity in context length. State Space Models (SSMs), including Mamba, have linear complexity and therefore may be an attractive alternative. This work compares a Transformer, Mamba-2, and their hybrid on three traffic datasets and four types of anomaly labeling. We show that, for real network attacks, the Transformer consistently leads regardless of the context length, whereas the advantage of Mamba-2 in long contexts is mostly visible for synthetic injections that mimic "scheduled" traffic fluctuations.