FUSION: A Hybrid Solution to Mitigate Catastrophic Representational Dilution (CRD) in Imbalanced Cybersecurity Data

Accurate classification of malicious commands in SSH honeypot data is critical for modern cyber defense, yet the task is complicated by severe class imbalance and the sparsity of discriminative signals in rare attack behaviors. We conduct a rigorous comparative analysis of classical, sequential, and attention-based models across baseline and enhanced variants, revealing a counterintuitive finding: a feature- and loss-optimized Enhanced Logistic Regression (ELR) model achieves significantly higher diagnostic efficacy (Macro F1: 0.6003) and a 600% relative improvement in rare-class detection compared to an Enhanced Transformer, while being over 13× faster at inference. This performance gap stems from a newly identified failure mode—Catastrophic Representational Dilution (CRD)—in which deep models suppress sparse, high-signal features during optimization under heavy imbalance. Building on these insights, we introduce FUSION (Feature-Unified Sequential and Integrated Network), a hybrid architecture designed to combine the rare-class sensitivity of ELR with the contextual robustness and calibration of Transformer models, providing a prescriptive path to resolve the CRD paradox.