---
title: "基于多专家混合架构的多任务恶意软件分类、打包检测与家族归属框架"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2606.30572v1"
permalink: "https://feed.astralor.com/items/itm_f2516e85bfe923d1c7e23072"
published: "2026-06-29T17:15:25.000Z"
score: 58
channel: "ai"
tags: ["EMBER特征","多任务学习","恶意软件分类","混合专家架构"]
---

# 基于多专家混合架构的多任务恶意软件分类、打包检测与家族归属框架

## 速览

该论文提出了一种基于混合专家（MoE）架构的统一多任务恶意软件分析框架，能够同时执行恶意软件家族分类、打包/未打包检测以及恶意/良性识别。系统支持高维EMBER特征和原始1D字节数组两种输入表示，通过自适应门控机制实现任务特定学习。实验显示多门MoE模型综合检测率达0.9744，失败率仅2.56%，且在突变分布偏移下表现出优越鲁棒性。

## 关键点

- 提出基于MoE的多任务恶意软件分析框架，同时解决分类、打包检测和家族归属
- 比较同质MoE、异质MoE和多门MoE三种架构，多门MoE性能最佳
- 在标准与对抗环境下测试，综合检测率0.9744，失败率2.56%

## 全文

Malware classification remains a challenging problem due to its inherent heterogeneity, the presence of packed binaries, and the diverse distribution of malware families. Traditional single-model detection mechanisms often fail to generalize across such diverse data, leading to degraded performance, particularly on obfuscated and rare malware samples. In this work, we propose a unified multi-task malware analysis framework based on Mixture of Experts (MoE) architectures. The proposed system evaluates performance across two different input representations, i.e., high-dimensional EMBER feature sets and raw 1D byte arrays extracted from Portable Executable files. It simultaneously performs three critical tasks: malware family classification, packed versus unpacked detection, and malware versus benign identification. By decomposing the problem into specialized expert networks and employing adaptive gating mechanisms, the model enables effective task-specific learning while maintaining overall scalability. We investigate multiple architectural variants, including Homogeneous MoE, Heterogeneous MoE, and Multi-Gate MoE (MMoE). Performance is evaluated in both standard and adversarial settings using original and mutated samples. The obtained results demonstrate that the Multi-Gate MoE model achieves the best performance, reaching a combined detection rate of 0.9744 with only $2.56\%$ failure rate. Moreover, this configuration exhibits improved robustness under mutation-induced distribution shifts. Our findings highlight the effectiveness of expert specialization and task-specific routing in handling complex malware distributions, making the proposed framework a promising direction for scalable and resilient malware detection systems.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_f2516e85bfe923d1c7e23072