KEVGraph: Exploitation-Aware Dependency Vulnerability Remediation
KEVGraph orders dependency upgrades so CISA KEV fixes precede higher-CVSS vulnerabilities.
KEVGraph is an eight-stage pipeline that turns dependency remediation into a KEV-aware set-cover problem using lockfiles, OSV, and the CISA KEV catalog. On 924 npm repositories covering 1,046 vulnerabilities and five KEV-listed packages, its ILP planner reached AUCCKEV 0.997, fixed the first KEV issue at step one, and needed 417 upgrades. CVSS-first and Dependabot-style ordering deferred that fix to step 18. Maven and PyPI evaluations reached AUCCKEV 0.988 and 1.000, and each plan includes a verifiable certificate for CISA BOD 22-01 checks.
- In the npm corpus, CVSS-first ordering deferred the first KEV fix by 17 upgrades.
- The ILP planner reached AUCCKEV 0.997 and fixed the first KEV at step one.
- It needed 417 upgrades, 15.9 percent fewer than the random mean.
- Results held across 924 npm, 1,200 Maven, and 300 PyPI repositories.
- Products
- npmMavenPyPIDependabot
- Organizations
- CISA
From the original article
1 min read at arxiv.orgDependency scanning tools surface hundreds of vulnerabilities but provide no exploitation-aware ordering, leaving practitioners to decide which upgrades to perform first with no principled guidance.
By Daniel Okumu Omondi · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.