A Dual-Module Machine Learning Framework for Vulnerability Assessment of Government Payment Gateways: Static Prioritisation and Runtime Detection

Abstract

Government electronic payment gateways concentrate public revenue and citizen data, making them high-value targets whose compromise carries national-security consequences. Yet vulnerability assessment in many public institutions remains manual, severity-driven, and unable to scale against both the growing volume of disclosed weaknesses and the continuous stream of live attack traffic. To address both vulnerability surfaces within a single coherent assessment layer, this paper presents a dual-module machine learning framework that unifies static prioritisation of disclosed vulnerabilities with runtime detection of malicious traffic. Methodologically, the static module prioritises disclosed vulnerabilities by pairing Term Frequency–Inverse Document Frequency (TF-IDF) text representation with Bayesian-optimised XGBoost multi-class classification over a corpus of 386,337 records, built by expanding National Vulnerability Database (NVD) records across their affected libraries using Open Source Vulnerabilities (OSV) data; the runtime module detects malicious HTTP requests using twelve engineered request features and Bayesian-optimised XGBoost binary classification on the CSIC 2010 dataset of 61,065 requests. On the key results, the static module attains a test accuracy of 0.8630, a macro-averaged F1-score of 0.8475, and High-tier recall of 0.9356; the runtime module attains an accuracy of 0.9101, an F1-score of 0.8879, and a ROC-AUC of 0.9796, raising attack recall from 0.087 under a rule-based signature baseline to 0.868. These results demonstrate that interpretable, low-cost learning models can strengthen vulnerability assessment for government payment infrastructure in resource-constrained settings, contributing the first data-driven, reproducible vulnerability-assessment model developed specifically for the Tanzanian Government Electronic Payment Gateway (GePG) context. As principal limitations, we identify the proxy-label limitation, on which the static module is trained against library-exposure breadth rather than a severity or exploitation measure, and the need for institution-specific validation on live GePG traffic, which together define the principal paths for refinement.