Decision-oriented vulnerability prioritization via context-aware probabilistic risk estimation
Computers and Security, cilt.170, 2026 (SCI-Expanded, Scopus)
- Yayın Türü: Makale / Tam Makale
- Cilt numarası: 170
- Basım Tarihi: 2026
- Doi Numarası: 10.1016/j.cose.2026.105062
- Dergi Adı: Computers and Security
- Derginin Tarandığı İndeksler: Science Citation Index Expanded (SCI-EXPANDED), Scopus, ABI/INFORM, Aerospace Database, Applied Science & Technology Source, Compendex, Criminal Justice Abstracts, INSPEC, Criminal Justice Periodical Index, Social Science Premium Collection (ProQuest), Business Source Ultimate (EBSCO), Criminology Collection (ProQuest), Technology Collection (ProQuest)
- Anahtar Kelimeler: Context-aware modeling, CVSS, Cyber risk, Cybersecurity analytics, Decision support, Decision-oriented prioritization, Risk reduction, Top-K optimization, Vulnerability prioritization, XGBoost
- Van Yüzüncü Yıl Üniversitesi Adresli: Evet
Özet
The increasing number of disclosed software vulnerabilities has made effective vulnerability remediation a critical challenge for organizations operating under limited security resources. Conventional prioritization approaches, particularly the Common Vulnerability Scoring System (CVSS), primarily assess technical severity but often fail to capture the contextual and organizational factors that determine real-world exploitation risk. Although recent exploit prediction models, such as the Exploit Prediction Scoring System (EPSS), have improved the estimation of exploitation likelihood, they remain primarily prediction-oriented and provide limited support for remediation decision-making under operational constraints. This study proposes a decision-oriented vulnerability prioritization framework that integrates context-aware probabilistic risk estimation with resource-constrained remediation planning. The proposed approach combines technical vulnerability characteristics with organizational contextual attributes, including asset criticality, internet exposure, exploit availability, business impact, and temporal information, to estimate the probability of successful exploitation. These calibrated probability estimates are subsequently employed as a practical proxy for expected remediation benefit, enabling vulnerability prioritization through a constrained Top-K selection strategy. The proposed framework was evaluated using a real-world enterprise dataset comprising 1406 vulnerability instances. Experimental performance was assessed using both predictive and decision-oriented evaluation metrics, including Accuracy, F1-score, ROC-AUC, Brier Score, Precision@K, Recall@K, NDCG@K, and RiskCapture@K. The results demonstrate that incorporating contextual organizational information substantially improves vulnerability prioritization compared with conventional CVSS-based assessment and widely adopted machine learning baselines. Additional ablation and statistical significance analyses further confirm that contextual features provide the primary contribution to predictive performance and decision quality. This study makes three main contributions. First, it reformulates vulnerability prioritization as a decision-oriented remediation problem rather than a severity-based ranking task. Second, it integrates context-aware probabilistic risk estimation with practical remediation planning under resource constraints. Third, it demonstrates that context-aware prioritization significantly improves decision quality and operational risk reduction while providing a practical and scalable foundation for future cost-aware, dependency-aware, and optimization-based vulnerability management frameworks.