A Survey on Vulnerability Prioritization: Taxonomy, Metrics, and Research Challenges

2025-02-16

AI Summary

Facing the dual challenges of rapidly increasing vulnerability volumes and constrained resources, existing vulnerability prioritization methods lack both a unified theoretical framework and practical deployability. This study conducts a systematic literature review (SLR) of 82 primary works to establish, for the first time, a five-dimensional unified taxonomy encompassing severity, exploitability, contextual relevance, predictive capability, and aggregation mechanisms. The analysis reveals critical bottlenecks: insufficient cross-domain generalizability, weak adaptability to dynamic environments, and low industrial integration. It further identifies dynamism, context awareness, and scalability as core future research directions. To bridge the structural gap between academic research and real-world practice, the study proposes a reusable evaluation framework and a comprehensive technology roadmap. These contributions advance both theoretical understanding and operational applicability in vulnerability management.

Technology Category

• Data Mining & Knowledge Management: Other Foundations of Data Mining & Knowledge Management
• Search and Optimization: Other Foundations of Search & Optimization
• Reasoning under Uncertainty: Other Foundations of Reasoning under Uncertainty

Application Category

• Security and Privacy: Large-scale security measurements
• Systems and Infrastructure for Web, Mobile and WoT: Virtualization and resource management in Web systems and infrastructures
• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics

Abstract

In the highly interconnected digital landscape of today, safeguarding complex infrastructures against cyber threats has become increasingly challenging due to the exponential growth in the number and complexity of vulnerabilities. Resource constraints necessitate effective vulnerability prioritization strategies, focusing efforts on the most critical risks. This paper presents a systematic literature review of 82 studies, introducing a novel taxonomy that categorizes metrics into severity, exploitability, contextual factors, predictive indicators, and aggregation methods. Our analysis reveals significant gaps in existing approaches and challenges with multi-domain applicability. By emphasizing the need for dynamic, context-aware metrics and scalable solutions, we provide actionable insights to bridge the gap between research and real-world applications. This work contributes to the field by offering a comprehensive framework for evaluating vulnerability prioritization methodologies and setting a research agenda to advance the state of practice.

Problem

• Addresses vulnerability prioritization challenges
• Introduces taxonomy for vulnerability metrics
• Identifies gaps in multi-domain applicability

Innovation

• Systematic literature review methodology
• Novel taxonomy for vulnerability metrics
• Dynamic context-aware scalable solutions