AI 中文总结
本研究提出面向SD-WAN环境的厂商中立PECR框架，经文献回顾与合成测试，发现其与CVSS排名存在差异，可生成可审计排名，为SD-WAN安全评估提供新视角。
AI 中文摘要
SD-WAN团队常使用静态严重性评分决定优先修复项，但这类评分未体现实时漏洞利用情况、网络暴露程度、攻击路径、业务影响或密码学迁移风险。本研究探究厂商中立的PECR框架能否生成与仅用CVSS不同且更具可追溯性的排名。我们回顾了2020-2026年19篇经DOI验证的出版物及5份当前NIST文档，该回顾支持10项归一化因子、1项加权评分及独立置信度指标。随后我们在5个合成案例中对比等权重PECR与CVSS，测试采用Kendall's τ_b、平均绝对排名偏移（MARS）、前三Jaccard重叠度（J₃）、因子移除及受限权重变化等指标。CVSS对案例的排名为A-D-B-E-C，PECR的排名为A-B-E-C-D，结果为τ_b=0.40、MARS=1.2、J₃=0.50；因仅含5个案例，精确τ检验无统计学显著性（p=0.483）。在1024种权重组合中，PECR排名在87.5%的组合下保持不变；在10项单因子移除测试中，8项测试下PECR排名保持不变。证据支持对严重性、漏洞利用及组织上下文采用独立度量；关于实时SD-WAN攻击路径及日常PQC分类的证据仍有限。PECR可生成不同且可审计的排名，但该合成测试未证明其能带来更好的运营结果或更易被人类理解。
英文摘要
SD-WAN teams often use static severity scores to decide what to fix first. These scores do not show live exploitation, network exposure, attack paths, business impact, or cryptographic migration risk. This study asks whether a vendor-neutral PECR framework can produce a different and more traceable ranking than CVSS alone. We reviewed 19 DOI-verified publications from 2020-2026 and five current NIST documents. The review supported ten normalized factors, one weighted score, and a separate confidence measure. We then compared equal-weight PECR with CVSS in five synthetic cases. The tests used Kendall's $τ_b$, mean absolute rank shift (MARS), top-three Jaccard overlap ($J_3$), factor removal, and bounded weight changes. CVSS ranked the cases A-D-B-E-C. PECR ranked them A-B-E-C-D. The results were $τ_b = 0.40$, MARS = 1.2, and $J_3 = 0.50$. The exact $τ$ test was not significant ($p = 0.483$) because the sample had only five cases. The PECR order remained unchanged in 87.5% of 1,024 weight combinations. It also remained unchanged in eight of ten single-factor removal tests. The evidence supports separate measures for severity, exploitation, and organizational context. Evidence for live SD-WAN attack paths and daily PQC triage is still limited. PECR can produce a different and auditable ranking. This synthetic test does not prove better operational results or better human understanding.
Comments14 pages, IEEE two-column format, 9 tables. Multivocal evidence review and reproducible synthetic evaluation
