Doktorandské kolokvium KAI - Issa Noufal (2.3.2026)
v pondelok 2.3.2026 o 13:10 hod. v miestnosti I 9
Prednášajúci: Issa Noufal
Názov: CAPG-v2: Impact-Weighted, Multi-Path Vulnerability Prioritization over CVE-Centric Attack-Position Graphs
Termín: 2.3.2026, 13:10 hod., I/9
Abstrakt:
CAPG-v2 is a graph-based framework for moving vulnerability management beyond isolated per-CVE scoring. While widely used scores such as CVSS and EPSS are useful for estimating severity or exploit likelihood, they do not capture how vulnerabilities interact across attack paths in a specific environment. CAPG-v2 addresses this gap by modeling vulnerabilities as transitions in an attack-position graph, assigning exploit-success priors and impact-weighted goal losses, and prioritizing vulnerabilities according to their contribution to expected attack loss. The framework supports both path-based scoring and a scalable Monte Carlo estimator of marginal expected-loss reduction, enabling patch prioritization under limited budgets. An experimental evaluation on a demo network compares six ranking strategies under different attacker policies (uniform and goal-greedy). It shows that overlap and impact-aware graph methods consistently outperform prior-only baselines.