---
title: "A Multi-task Mixture of Experts Framework for Malware Classification, Packing Detection, and Family Attribution"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2606.30572v1"
permalink: "https://feed.astralor.com/items/itm_f2516e85bfe923d1c7e23072"
published: "2026-06-29T17:15:25.000Z"
score: 58
channel: "ai"
tags: ["EMBER Features","Multi-task Learning","Malware Classification","Mixture-of-Experts"]
---

# A Multi-task Mixture of Experts Framework for Malware Classification, Packing Detection, and Family Attribution

## At a glance

This paper proposes a unified multi-task malware analysis framework based on Mixture of Experts (MoE) architectures, capable of simultaneously performing malware family classification, packed/unpacked detection, and malware/benign identification. It supports two input representations: high-dimensional EMBER features and raw 1D byte arrays. The Multi-Gate MoE model achieves a combined detection rate of 0.9744 with only 2.56% failure rate, and shows robust performance under mutation-induced distribution shifts.

## Key points

- Proposes a multi-task malware analysis framework based on MoE for simultaneous classification, packing detection, and family attribution
- Compares Homogeneous MoE, Heterogeneous MoE, and Multi-Gate MoE; MMoE achieves best performance
- Evaluated in both standard and adversarial settings; detection rate 0.9744, failure rate 2.56%

## Full text

Malware classification remains a challenging problem due to its inherent heterogeneity, the presence of packed binaries, and the diverse distribution of malware families. Traditional single-model detection mechanisms often fail to generalize across such diverse data, leading to degraded performance, particularly on obfuscated and rare malware samples. In this work, we propose a unified multi-task malware analysis framework based on Mixture of Experts (MoE) architectures. The proposed system evaluates performance across two different input representations, i.e., high-dimensional EMBER feature sets and raw 1D byte arrays extracted from Portable Executable files. It simultaneously performs three critical tasks: malware family classification, packed versus unpacked detection, and malware versus benign identification. By decomposing the problem into specialized expert networks and employing adaptive gating mechanisms, the model enables effective task-specific learning while maintaining overall scalability. We investigate multiple architectural variants, including Homogeneous MoE, Heterogeneous MoE, and Multi-Gate MoE (MMoE). Performance is evaluated in both standard and adversarial settings using original and mutated samples. The obtained results demonstrate that the Multi-Gate MoE model achieves the best performance, reaching a combined detection rate of 0.9744 with only $2.56\%$ failure rate. Moreover, this configuration exhibits improved robustness under mutation-induced distribution shifts. Our findings highlight the effectiveness of expert specialization and task-specific routing in handling complex malware distributions, making the proposed framework a promising direction for scalable and resilient malware detection systems.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_f2516e85bfe923d1c7e23072