TrafficMoE: LLM-based mixture-of-experts framework for multi-task network traffic classification

Abstract Network traffic analysis is fundamentally challenged by the need to accurately identify malicious behaviors and application types from massive, structurally heterogeneous packet data. Existing deep learning and Large Language Model (LLM)-based methods typically rely on shared parameter spaces optimized for isolated, single-task scenarios. Consequently, when deployed in dynamic multi-task environments, these approaches may be affected by cross-task gradient interference and negative transfer. To address these limitations, we propose TrafficMoE, an LLM-based Mixture-of-Experts (MoE) framework for supervised multi-task network traffic classification. Specifically, TrafficMoE formulates heterogeneous traffic tasks under a unified instruction-to-label generation paradigm by converting packet metadata into text. To mitigate task interference, the framework integrates a shared traffic expert to capture common semantics, multiple task-specialized experts to separate domain knowledge, and a lightweight context-aware router for automatic, sample-wise dispatching under mixed-task inputs. Furthermore, to support continual task evolution, we design a modular sequential expansion strategy that accommodates new tasks by adding a single expert and updating the router. Extensive evaluations across ten public benchmark datasets show that TrafficMoE achieves an average F1-score of 0.9823, while supporting modular task expansion with reduced adaptation overhead.