AI 中文总结
该研究提出了面向SD-WAN的PECR漏洞优先级排序方法，通过9类因素结合实现更精准排序，经实验验证其队列区分度与压力测试鲁棒性，明确其未确立预测准确性等局限。
AI 中文摘要
软件定义广域网（SD-WAN）将操作权限集中于控制器、编排器和面向互联网的边缘节点，但仅基于严重程度的修复队列无法反映当前的暴露情况或证据质量。本文定义了预测性暴露与加密就绪性（PECR），这是一种决策支持方法，它结合了9个归一化的严重程度、威胁、可达性和后果因素，同时分别报告置信度和得分区间。加密依赖项被纳入独立的迁移队列。评估使用了100个角色和区域条件化的综合漏洞-资产记录（涉及62个角色一致的资产），以及30个独立的生成器重复实验。与基于操作的PECR排序相比，仅CVSS、仅EPSS、优先KEV、CVSS×EPSS队列的Kendall τ值分别为0.196、0.221、0.301和0.234；更强的五因素轻量上下文比较器的τ值为0.755。在30000次联合狄利克雷权重抽样中，在广泛、中等和窄范围扰动下，τ的中位数分别为0.836、0.893和0.924。掩盖10%的因素单元格会将47条记录标记为证据受限，因为它们的区间跨越了决策边界。该研究确立了可执行规范、综合队列区分和压力测试鲁棒性，但未确立预测准确性、避免损失或生产有效性，因为未使用真实结果标签。
英文摘要
Software-defined wide-area networking concentrates operational authority in controllers, orchestrators, and Internet-facing edges, but severity-only remediation queues do not represent current exposure or evidence quality. This paper specifies Predictive Exposure and Cryptographic Readiness (PECR), a decision-support method that combines nine normalized severity, threat, reachability, and consequence factors while reporting confidence and score intervals separately. Cryptographic dependencies enter an independent migration queue. The evaluation uses 100 role- and zone-conditioned synthetic vulnerability-asset records over 62 role-consistent assets, plus 30 independent generator replications. Against the operational PECR order, CVSS-only, EPSS-only, KEV-first, and CVSS x EPSS queues yield Kendall $τ$ values of 0.196, 0.221, 0.301, and 0.234; a stronger five-factor context-lite comparator yields 0.755. Across 30,000 joint Dirichlet weight draws, median $τ$ is 0.836, 0.893, and 0.924 under broad, moderate, and narrow perturbations. Masking 10% of factor cells labels 47 records as evidence-limited because their intervals cross a decision boundary. The study establishes executable specification, synthetic queue differentiation, and stress-test robustness. It does not establish predictive accuracy, avoided loss, or production effectiveness because no real outcome labels are used.
Comments17 pages, 8 tables, 2 figures. ACM article format
