A Multi-task Mixture of Experts Framework for Malware Classification, Packing Detection, and Family Attribution

• URL: http://arxiv.org/abs/2606.30572v1
• Date: Mon, 29 Jun 2026 17:15:25 GMT
• Title: A Multi-task Mixture of Experts Framework for Malware Classification, Packing Detection, and Family Attribution
• Abstract summary: We propose a unified multi-task malware analysis framework based on Mixture of Experts (MoE) architectures.<n>It simultaneously performs three critical tasks: malware family classification, packed versus unpacked detection, and malware versus benign identification.<n>We investigate multiple architectural variants, including Homogeneous MoE, Heterogeneous MoE, and Multi-Gate MoE.
• Score: 2.008200933045584
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Malware classification remains a challenging problem due to its inherent heterogeneity, the presence of packed binaries, and the diverse distribution of malware families. Traditional single-model detection mechanisms often fail to generalize across such diverse data, leading to degraded performance, particularly on obfuscated and rare malware samples. In this work, we propose a unified multi-task malware analysis framework based on Mixture of Experts (MoE) architectures. The proposed system evaluates performance across two different input representations, i.e., high-dimensional EMBER feature sets and raw 1D byte arrays extracted from Portable Executable files. It simultaneously performs three critical tasks: malware family classification, packed versus unpacked detection, and malware versus benign identification. By decomposing the problem into specialized expert networks and employing adaptive gating mechanisms, the model enables effective task-specific learning while maintaining overall scalability. We investigate multiple architectural variants, including Homogeneous MoE, Heterogeneous MoE, and Multi-Gate MoE (MMoE). Performance is evaluated in both standard and adversarial settings using original and mutated samples. The obtained results demonstrate that the Multi-Gate MoE model achieves the best performance, reaching a combined detection rate of 0.9744 with only $2.56\%$ failure rate. Moreover, this configuration exhibits improved robustness under mutation-induced distribution shifts. Our findings highlight the effectiveness of expert specialization and task-specific routing in handling complex malware distributions, making the proposed framework a promising direction for scalable and resilient malware detection systems.

Related papers

• SuppreSensing: Expert-Guided Feature Recalibration and Discrepancy Augmentation for Multimodal Object Detection [19.446402308279676]
  We propose SuppreSensing, which reformulates multimodal fusion as a selective collaboration process.<n>SupreSensing first designs an Expert-driven Multimodal Feature Recalibration (EMFR) module.<n>A modality-specific augmentation strategy is employed to attribute specific modality features.<n>Experiments on the DroneVehicle and VEDAI datasets demonstrate that SuppreSensing achieves state-of-the-art detection performance.
  arXiv  Detail & Related papers  (2026-08-21T10:06:00Z)
• Malformer: A Multi-Modal Malware Detector Using Transformers [2.8093059118703345]
  We present Malformer, a quadrimodal malware detection model that incorporates text, image, graph, and audio representations of Windows executables.<n>Malformer achieved 98.3% accuracy and an F1 score of 0.9833, outperforming both unimodal baselines and bimodal detectors by 4.6-17.6 percentage points.
  arXiv  Detail & Related papers  (2026-08-19T15:46:28Z)
• XMatchAD: A Cross-Modal Matching Perspective on Reconstruction-based Anomaly Detection [30.401044523780723]
  XMatchAD is a novel UAD framework that reinterprets the task from a pseudo cross-modal matching perspective.<n>Our method consistently achieves superior performance, outperforming state-of-the-art methods in multi-class anomaly detection and localization.
  arXiv  Detail & Related papers  (2026-07-26T13:47:10Z)
• Architecture-Aware Multi-Design Generation for Repository-Level Feature Addition [53.50448142467294]
  RAIM is a multi-design and architecture-aware framework for repository-level feature addition.<n>It shifts away from linear patching by generating multiple diverse implementation designs.<n>Experiments on the NoCode-bench Verified dataset demonstrate that RAIM establishes a new state-of-the-art performance.
  arXiv  Detail & Related papers  (2026-03-02T12:50:40Z)
• ShortcutBreaker: Low-Rank Noisy Bottleneck with Global Perturbation Attention for Multi-Class Unsupervised Anomaly Detection [59.89803740308262]
  ShortcutBreaker is a novel unified feature-reconstruction framework for MUAD tasks.<n>It features two key innovations to address the issue of shortcuts.<n>The proposed method achieves a remarkable image-level AUROC of 99.8%, 98.9%, 90.6%, and 87.8% on four datasets.
  arXiv  Detail & Related papers  (2025-10-21T06:51:30Z)
• Agent4FaceForgery: Multi-Agent LLM Framework for Realistic Face Forgery Detection [108.5042835056188]
  This work introduces Agent4FaceForgery to address two fundamental problems.<n>How to capture the diverse intents and iterative processes of human forgery creation.<n>How to model the complex, often adversarial, text-image interactions that accompany forgeries in social media.
  arXiv  Detail & Related papers  (2025-09-16T01:05:01Z)
• RouteMark: A Fingerprint for Intellectual Property Attribution in Routing-based Model Merging [69.2230254959204]
  We propose RouteMark, a framework for IP protection in merged MoE models.<n>Our key insight is that task-specific experts exhibit stable and distinctive routing behaviors under probing inputs.<n>For attribution and tampering detection, we introduce a similarity-based matching algorithm.
  arXiv  Detail & Related papers  (2025-08-03T14:51:58Z)
• Cluster-Driven Expert Pruning for Mixture-of-Experts Large Language Models [24.64757529640278]
  Cluster-driven Expert Pruning (C-Prune) is a novel two-stage framework for adaptive task-specific compression of large language models.<n>C-Prune operates through layer-wise expert clustering, which groups functionally similar experts within each MoE layer.<n>We validate C-Prune through extensive experiments on multiple MoE models and benchmarks.
  arXiv  Detail & Related papers  (2025-04-10T14:46:26Z)
• MAMM-Refine: A Recipe for Improving Faithfulness in Generation with Multi-Agent Collaboration [63.31211701741323]
  We extend multi-agent multi-model reasoning to generation, specifically to improving faithfulness through refinement.<n>We design intrinsic evaluations for each subtask, with our findings indicating that both multi-agent (multiple instances) and multi-model (diverse LLM types) approaches benefit error detection and critiquing.<n>We consolidate these insights into a final "recipe" called Multi-Agent Multi-Model Refinement (MAMM-Refine), where multi-agent and multi-model collaboration significantly boosts performance.
  arXiv  Detail & Related papers  (2025-03-19T14:46:53Z)
• Optimizing Multispectral Object Detection: A Bag of Tricks and Comprehensive Benchmarks [49.84182981950623]
  Multispectral object detection, utilizing RGB and TIR (thermal infrared) modalities, is widely recognized as a challenging task.<n>It requires not only the effective extraction of features from both modalities and robust fusion strategies, but also the ability to address issues such as spectral discrepancies.<n>We introduce an efficient and easily deployable multispectral object detection framework that can seamlessly optimize high-performing single-modality models.
  arXiv  Detail & Related papers  (2024-11-27T12:18:39Z)
• Cross-System Categorization of Abnormal Traces in Microservice-Based Systems via Meta-Learning [8.634734590552537]
  TraFaultDia is an AIOps framework to automatically classify abnormal traces into fault categories for MSS.<n>TraFaultDia achieves 93.26% and 85.20% accuracy on 50 new classification tasks for TrainTicket and OnlineBoutique.<n>In the cross-system context, when TraFaultDia is applied to a MSS different from the one it is trained on, TraFaultDia gets an average accuracy of 92.19% and 84.77%.
  arXiv  Detail & Related papers  (2024-03-27T20:38:04Z)
• MDENet: Multi-modal Dual-embedding Networks for Malware Open-set Recognition [17.027132477210092]
  We propose the Multi-modal Dual-Embedding Networks, dubbed MDENet, to take advantage of comprehensive malware features. We also enrich our previously proposed large-scaled malware dataset MAL-100 with multi-modal characteristics.
  arXiv  Detail & Related papers  (2023-05-02T08:09:51Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.