Classifying cybersecurity vulnerabilities using the Common Weakness Enumeration (CWE) taxonomy is challenging due to extreme class imbalance and strong hierarchical dependencies among weakness categories. Although oversampling techniques such as Synthetic Minority Oversampling Technique (SMOTE) and Adaptive Synthetic Sampling (ADASYN) are widely adopted to mitigate class imbalance, their effectiveness for hierarchical CWE text classification remains largely unexplored. This paper proposes a Hierarchy-Aware RoBERTa framework that explicitly incorporates CWE structural information through learnable parent-class embeddings, preserving taxonomic consistency. Our experiments demonstrate that synthetic interpolation in high-dimensional embedding spaces violates the inherent parent-child constraints of the CWE hierarchy, offering only marginal benefits for classical ML models while consistently degrading deep learning architectures. Evaluated on a CWE Research Concept dataset, the proposed model achieves a weighted F1-score of 0.76 without data augmentation, outperforming all baselines with notable gains on minority classes, including the Class category whose F1-score improves from 0.49 to 0.60 over the BERT baseline. Our results suggest that hierarchyaware representation learning is a more principled alternative to oversampling for structured vulnerability classification.
Bipin Chhetri, D. Giri, Avishek Kadel et al.· Annual International Compute...· 0 citations
Reinforcement learning-based intrusion detection systems achieve strong detection performance in unbalanced network traffic, but offer limited insight into which features have played a significant role in driving their decisions. To determine the key network features in detecting malicious packets, this paper presents a Graph Attention Network (GAT) model architecture applied to a feature dependency graph to analyze inter-feature influence in an RL-based intrusion detection system. Rather than ranking features independently, the framework uses GAT attention weights to reveal which feature relationships the model relies on most and how those relationships differ between malicious and benign traffic networks. Applied to a Rainbow DQN agent, a well-known RL-based agent, and trained on real botnet network traffic, the analysis identifies interpretable behavioral signatures in the feature influence structure that distinguish attack traffic from legitimate connections. The results demonstrate that attention-based influence analysis provides a richer characterization of detection decisions than per-feature importance methods alone.
Tania-Amanda Nkoyo Fredrick Eneye, A. Namin· Annual International Compute...· 0 citations