HARP：用于基于查询的CVE优先级排序的分层自适应偏好融合排名方法

中文摘要 AI 辅助

漏洞优先级排序本质上依赖于偏好，因为同一CVE在不同操作偏好场景下会获得不同的修复优先级。现有的评分系统和排名方法通常采用固定准则。实际中，组织虽已处于某一偏好场景，但该偏好往往是隐性的，难以转化为书面提示指令，而分诊查询通常未编码该偏好，当前场景下过往已验证的分诊案例更易获取。本文研究该场景下基于查询的CVE优先级排序问题，提出HARP——一种基于图的多视图框架，可结合自然语言查询与当前偏好场景下的历史标注示例支持库对候选进行排名，无需该场景的显式文本摘要。HARP从漏洞知识图谱中检索证据，基于策略条件的全局、企业和用户视图对候选评分，并从采样支持中拟合视图融合权重。在三个偏好场景及多个主干LLM上的实验表明，HARP优于多个基线方法，验证了其有效性。

英文摘要

Vulnerability prioritization is inherently preference dependent, since the same CVE can receive different remediation priority under different operational preference scenarios. Existing scoring systems and ranking methods typically assume a fixed criterion. In practice, organizations already operate under a preference scenario, but this preference is often implicit and difficult to express as a written prompt instruction, while triage queries usually do not encode it. Past validated triage cases under the current scenario are more readily available. We study query-based CVE prioritization in this setting and propose HARP, a graph-grounded multi-view framework that ranks candidates from a natural-language query together with a support bank of historical labeled examples from the current preference scenario, without requiring an explicit textual summary of that scenario. HARP retrieves evidence from a vulnerability knowledge graph, scores candidates with policy-conditioned global, enterprise, and user views, and fits view-fusion weights from sampled supports. Experiments across three preference scenarios and multiple backbone LLMs show that HARP outperforms multiple baselines, expressing our method's effectiveness.

发表机构

• University of Virginia（弗吉尼亚大学）
• NEC Laboratories America（美国 NEC 实验室）

机构由 AI 辅助整理，请以论文原文为准。