Search papers, labs, and topics across Lattice.
This paper introduces HARP, a novel framework for query-based CVE prioritization that leverages a graph-grounded multi-view approach to adaptively rank vulnerabilities based on implicit operational preferences. By integrating historical triage cases and utilizing a vulnerability knowledge graph, HARP effectively scores candidates without needing explicit preference prompts. Experimental results demonstrate that HARP significantly outperforms existing prioritization methods across various scenarios, highlighting its adaptability and effectiveness in real-world applications.
HARP outperforms traditional CVE prioritization methods by dynamically adapting to implicit operational preferences, revealing the power of leveraging historical data without explicit prompts.
Vulnerability prioritization is inherently preference dependent, since the same CVE can receive different remediation priority under different operational preference scenarios. Existing scoring systems and ranking methods typically assume a fixed criterion. In practice, organizations already operate under a preference scenario, but this preference is often implicit and difficult to express as a written prompt instruction, while triage queries usually do not encode it. Past validated triage cases under the current scenario are more readily available. We study query-based CVE prioritization in this setting and propose HARP, a graph-grounded multi-view framework that ranks candidates from a natural-language query together with a support bank of historical labeled examples from the current preference scenario, without requiring an explicit textual summary of that scenario. HARP retrieves evidence from a vulnerability knowledge graph, scores candidates with policy-conditioned global, enterprise, and user views, and fits view-fusion weights from sampled supports. Experiments across three preference scenarios and multiple backbone LLMs show that HARP outperforms multiple baselines, expressing our method's effectiveness.
