A Hybrid Mamba-2 Forecaster for On-Device Anomaly Detection
Abstract
We present a hybrid Mamba-2 structured state-space forecaster for detecting anomalies in continuous time-series data on consumer CPU hardware — with no cloud dependency and no labeled attack or failure data required for training. The model learns a baseline of normal behavior and flags deviations as forecast error.
We validate the architecture in two domains: (1) Vigilo, an IoT network anomaly detector achieving 75% detection at 1% false-positive rate on IoT-23 (20 malware families); and (2) a predictive-maintenance adaptation on NASA C-MAPSS achieving 100% detection at 1% FPR on single-operating-condition subsets, with median early warning of 54–60 cycles before failure. Both run entirely on CPU.
1. Introduction
Connected devices and industrial equipment generate continuous telemetry, but most organizations cannot send that data to the cloud. Signature-based detection fails against novel malware; rule-based maintenance thresholds require expert tuning per asset.
We pursue behavioral anomaly detection: learn what normal looks like from benign data alone, then alert when behavior deviates — using a model small enough for edge deployment (~1.3M parameters).
Contributions
- A compact hybrid Mamba-2 forecaster combining SSD blocks, sparse window attention, and MoE FFN for O(1) memory per timestep.
- Vigilo — on-device IoT network anomaly detection evaluated on IoT-23 with honest benchmark methodology.
- Predictive maintenance adaptation on C-MAPSS with per-asset baseline normalization, defining deployable vs. future-work operating envelopes.
2. Forecaster Architecture
The forecaster predicts the next behavioral window from history. Anomaly score = prediction error between forecast and observed behavior.
Model Configuration
| Total parameters | ~1.3M |
| d_model | 128 |
| Layers | 4 (2 Mamba-2 + 2 sparse attention) |
| MoE experts | 4, top-2 routing |
| Attention window | 512 |
| Training | CPU (~1 minute per dataset) |
Mamba-2 SSD blocks provide O(1) state memory per timestep for long behavioral histories. Sparse window attention handles local correlations. MoE FFN increases expressiveness without proportional compute cost. Vigilo adds a dedicated beaconing detector for stealthy periodic C2 channels.
3. Vigilo — IoT Network Anomaly Detection
Vigilo reads Zeek conn.log files, groups traffic into 5-minute behavioral windows per device (15 features), and scores forecast error. See the Vigilo product page for deployment details.
IoT-23 Benchmark Results
Trained on benign honeypot captures (29 devices). Evaluated on 20 malware families (Mirai, Okiru, Torii, Gagfyt, Hajime, Kenjiro, etc.):
| Metric | Value |
|---|---|
| Detection @ ~1% FPR | 75% (15/20 infected devices) |
| Benign baseline (device peak) | p95 = 1.93, max = 1.97 |
| Training data | Benign traffic only |
| Model | ~1.3M params, CPU, fully local |
What It Catches
- Loud attacks: port scans, DDoS, noisy botnets (5–1444× above baseline)
- All high-volume malicious behavior flagged with high confidence
What It Misses
- Stealthy low-volume C2 (16 malicious flows / 3,193 benign)
- Per-device baselining is the path to better stealthy detection
Key Findings
- Adding PC benign traffic dropped detection 75% → 20%
- Threshold calibration on small benign sets causes run-to-run variance
- IoT-23 is lab data; field validation pending
4. Predictive Maintenance — C-MAPSS
The same forecaster predicts the next cycle’s sensor vector from prior cycles. Trained on the first 50% of each engine’s life (assumed healthy). Each engine normalized by its own first 20 cycles.
C-MAPSS Benchmark Results
| Subset | Op. Cond. | Fault Modes | Error Rise | Detection @1% FPR | Median Lead |
|---|---|---|---|---|---|
| FD001 | 1 | 1 | 1.9 → 53.1 (~28×) | 100% (20/20) | 54 cycles |
| FD003 | 1 | 2 | 2.2 → 91.3 (~41×) | 100% (20/20) | 60 cycles |
| FD002 | 6 | 1 | non-monotonic | 2% (1/52) | — |
| FD004 | 6 | 2 | non-monotonic | 4% (2/49) | — |
What Works
- Single operating condition: flat error while healthy, sharp rise at failure
- Multiple fault modes are not the problem (FD003 works perfectly)
- Deployable on steady-duty pumps, motors, base-load fans
What Doesn’t (Yet)
- Multiple operating conditions collapse detection to 2–4% (FD002/FD004)
- Regime-aware normalization required for variable-duty equipment
5. Discussion & Future Work
Mamba-2’s O(1) recurrent state makes long device histories tractable on CPU-only edge hardware without growing KV cache. The honest results define clear operating envelopes rather than overstating generalization.
- Vigilo per-device in-place baselining
- PdM regime-aware normalization for variable-duty assets
- Field validation on real home/enterprise network traffic
6. Conclusion
A compact hybrid Mamba-2 forecaster (~1.3M parameters) detects meaningful anomalies in network traffic and industrial sensor data while running entirely on CPU with benign-only training. Vigilo achieves 75% detection at 1% FPR on IoT-23; the same backbone achieves 100% at 1% FPR on single-condition C-MAPSS subsets.
Vigilo is open source at github.com/pgalyen1987/Vigilo.
References
- Dao & Gu [2024]: “Transformers are SSMs.” ICML 2024. arXiv:2405.21060
- Gu & Dao [2023]: “Mamba: Linear-Time Sequence Modeling with Selective State Spaces.” arXiv:2312.00752
- Garcia et al. [2020]: “IoT-23: A Labeled Dataset with Malicious and Benign IoT Network Traffic.”
- Saxena et al. [2008]: “Damage Propagation Modeling for Aircraft Engine Run-to-Failure Simulation (C-MAPSS).” PHM 2008.
- Su et al. [2019]: “OmniAnomaly.” KDD 2019.