这篇论文用MoE同时干分类、查加壳、判黑白三种活，检测率97.44%，比单模型稳多了，做恶意软件方向的值得看。
该论文提出一个基于混合专家（MoE）架构的统一多任务恶意软件分析框架，同时在高维EMBER特征集和原始1D字节数组上处理三种任务：恶意软件家族分类、加壳/未加壳检测、恶意/良性识别。研究了Homogeneous MoE、Heterogeneous MoE和Multi-Gate MoE（MMoE）三种变体，在原始和变异样本上评估对抗鲁棒性。MMoE模型取得最佳性能，综合检测率0.9744，失败率仅2.56%，且在分布偏移下表现出更强的鲁棒性。结果表明专家专业化和任务特定路由能有效应对复杂恶意软件分布。
A Multi-task Mixture of Experts Framework for Malware Classification, Packing Detection, and Family Attribution
Malware classification remains a challenging problem due to its inherent heterogeneity, the presence of packed binaries, and the diverse distribution of malware families. Traditional single-model detection mechanisms often fail to generalize across such diverse data, leading to degraded performance, particularly on obfuscated and rare malware samples. In this work, we propose a unified multi-task malware analysis framework based on Mixture of Experts (MoE) architectures. The proposed system evaluates performance across two different input representations, i.e., high-dimensional EMBER feature sets and raw 1D byte arrays extracted from Portable Executable files. It simultaneously performs three critical tasks: malware family classification, packed versus unpacked detection, and malware versus benign identification. By decomposing the problem into specialized expert networks and employing adaptive gating mechanisms, the model enables effective task-specific learning while maintaining overall scalability. We investigate multiple architectural variants, including Homogeneous MoE, Heterogeneous MoE, and Multi-Gate MoE (MMoE). Performance is evaluated in both standard and adversarial settings using original and mutated samples. The obtained results demonstrate that the Multi-Gate MoE model achieves the best performance, reaching a combined detection rate of 0.9744 with only $2.56\%$ failure rate. Moreover, this configuration exhibits improved robustness under mutation-induced distribution shifts. Our findings highlight the effectiveness of expert specialization and task-specific routing in handling complex malware distributions, making the proposed framework a promising direction for scalable and resilient malware detection systems.