Search papers, labs, and topics across Lattice.
This paper introduces a multi-task malware analysis framework leveraging Mixture of Experts (MoE) architectures to tackle the challenges of malware classification, packing detection, and family attribution. By utilizing both high-dimensional EMBER feature sets and raw byte arrays, the framework employs specialized expert networks with adaptive gating mechanisms to enhance task-specific learning and scalability. The Multi-Gate MoE model outperforms other configurations, achieving a detection rate of 0.9744 with a mere 2.56% failure rate, demonstrating significant robustness against mutation-induced distribution shifts.
Expert specialization in malware detection leads to a remarkable 97.44% accuracy, even against adversarial mutations.
Malware classification remains a challenging problem due to its inherent heterogeneity, the presence of packed binaries, and the diverse distribution of malware families. Traditional single-model detection mechanisms often fail to generalize across such diverse data, leading to degraded performance, particularly on obfuscated and rare malware samples. In this work, we propose a unified multi-task malware analysis framework based on Mixture of Experts (MoE) architectures. The proposed system evaluates performance across two different input representations, i.e., high-dimensional EMBER feature sets and raw 1D byte arrays extracted from Portable Executable files. It simultaneously performs three critical tasks: malware family classification, packed versus unpacked detection, and malware versus benign identification. By decomposing the problem into specialized expert networks and employing adaptive gating mechanisms, the model enables effective task-specific learning while maintaining overall scalability. We investigate multiple architectural variants, including Homogeneous MoE, Heterogeneous MoE, and Multi-Gate MoE (MMoE). Performance is evaluated in both standard and adversarial settings using original and mutated samples. The obtained results demonstrate that the Multi-Gate MoE model achieves the best performance, reaching a combined detection rate of 0.9744 with only $2.56\%$ failure rate. Moreover, this configuration exhibits improved robustness under mutation-induced distribution shifts. Our findings highlight the effectiveness of expert specialization and task-specific routing in handling complex malware distributions, making the proposed framework a promising direction for scalable and resilient malware detection systems.
