Doctoral colloquium - Issa Noufal (2.3.2026)
Monday 2.3.2026 at 13:10, Lecture room I 9
Issa Noufal:
CAPG-v2: Impact-Weighted, Multi-Path Vulnerability Prioritization over CVE-Centric Attack-Position Graphs
Abstract:
CAPG-v2 is a graph-based framework for moving vulnerability management beyond isolated per-CVE scoring. While widely used scores such as CVSS and EPSS are useful for estimating severity or exploit likelihood, they do not capture how vulnerabilities interact across attack paths in a specific environment. CAPG-v2 addresses this gap by modeling vulnerabilities as transitions in an attack-position graph, assigning exploit-success priors and impact-weighted goal losses, and prioritizing vulnerabilities according to their contribution to expected attack loss. The framework supports both path-based scoring and a scalable Monte Carlo estimator of marginal expected-loss reduction, enabling patch prioritization under limited budgets. An experimental evaluation on a demo network compares six ranking strategies under different attacker policies (uniform and goal-greedy). It shows that overlap and impact-aware graph methods consistently outperform prior-only baselines.