We propose Tensor-Trained Low-Rank Adaptation Mixture of Experts (TT-LoRA MoE), a novel computational framework integrating Parameter-Efficient Fine-Tuning (PEFT) with sparse MoE routing to address scalability challenges in large model deployments. Unlike traditional MoE approaches, which face substantial computational overhead as expert counts grow, TT-LoRA MoE decomposes training into two distinct, optimized stages. First, we independently train lightweight, tensorized low-rank adapters (TT-LoRA experts), each specialized for specific tasks. Subsequently, these expert adapters remain frozen, eliminating inter-task interference and catastrophic forgetting in multi-task setting. A sparse MoE router, trained separately, dynamically leverages base model representations to select exactly one specialized adapter per input at inference time, automating expert selection without explicit task specification. This structured decoupling significantly enhances computational efficiency and flexibility: uses only 2% of LoRA, 0.3% of Adapters and 0.03% of AdapterFusion parameters and outperforms AdapterFusion by 4 % on average in multi-tasking, enabling practical and scalable multi-task inference deployments.

The introduction of transformers has been an important breakthrough for AI research and application, as transformers are the foundation behind Generative AI. Transformers are promising in cybersecurity, especially malware analysis. The reason is the flexibility of the transformer models in handling long sequential features and understanding contextual relationships. However, as the use of transformers for malware analysis is still in the infancy stage, it is critical to evaluate, systematize, and contextualize existing literature to foster future research. This Systematization of Knowledge (SoK) paper aims to provide a comprehensive analysis of transformer-based approaches designed for malware analysis. Based on our systematic analysis of existing knowledge, we structure and propose taxonomies based on: (a) how different transformers are adapted, organized, and modified across various use cases; and (b) how diverse feature types and their representation capabilities are reflected. We also provide an inventory of datasets used to explore multiple research avenues in the use of transformers for malware analysis and discuss open challenges with future research directions. We believe that this SoK paper will assist the research community in gaining detailed insights from existing work and will serve as a foundational resource for implementing novel research using transformers for malware analysis.

Current systems, relying heavily on single-modality analysis, often fail to identify sophisticated malware such as zero-day attacks. Our proposed Malformer model offers a novel approach by integrating multiple data modalities-text, image, and graph, using advanced transformer models and cross-attention fusion mechanisms. This multimodal approach aims to capture a comprehensive spectrum of malware characteristics that might have been missed under single-modality analysis. The model's integration of cross-modal attention and modality fusion techniques is expected to garner a deeper understanding and identification of complex malware characteristics, potentially establishing a new frontier in cybersecurity defense mechanisms.