Technical Summary: ThreatLens – Evidence-Guided Ranking of High-Priority CVEs

Problem Statement

Modern vulnerability management faces a critical scalability challenge: the continuous disclosure of Common Vulnerabilities and Exposures (CVEs) far exceeds the capacity of security teams to investigate, validate, and remediate them. Existing prioritization signals, such as the Common Vulnerability Scoring System (CVSS), Exploit Prediction Scoring System (EPSS), and public exploit availability, are often fragmented, time-sensitive, or insufficient on their own.

A significant methodological flaw in prior research is temporal leakage. Many studies evaluate prioritization models using evidence that would not have been available at the time a decision was made (e.g., using future exploit data to rank past vulnerabilities). This "perfect labeling assumption" leads to retrospective rankings that overstate model performance. The core problem addressed by this paper is how to prioritize vulnerabilities under realistic time constraints, using only evidence available at a specific decision point, to identify which CVEs will become operationally urgent (i.e., enter the CISA Known Exploited Vulnerabilities or KEV catalog) before formal cataloging occurs.

Methodology: The ThreatLens Framework

ThreatLens is a deployment-realistic framework designed to rank CVEs within weekly analyst review queues. It treats vulnerability prioritization as a time-aware ranking problem rather than a static binary classification task.

1. Data Construction and Temporal Alignment

The framework constructs CVE-time snapshots, representing a specific CVE observed at a specific weekly cutoff date.

• Evidence Sources: The system integrates heterogeneous public data, including NVD descriptions, CVSS metadata, EPSS scores, GitHub Security Advisory (GHSA) activity, and public exploit signals from Exploit-DB and Metasploit.
• Cutoff Validity: All evidence is strictly aligned to the weekly cutoff. For example, EPSS scores use the value available on or before the cutoff; advisory counts are filtered by publication/modification times; and exploit indicators are filtered by publication dates.
• Leakage Mitigation: To prevent temporal leakage, the system scrubs mutable metadata (e.g., last-modified dates, raw URLs, tags) and excludes exact dates. Temporal context is encoded via relative features (e.g., CVE age, days since first exploit) rather than absolute timestamps.
• Labeling: The system uses future entry into the CISA KEV catalog as a weak supervision signal. A snapshot is labeled positive if the CVE enters KEV within a 30-day horizon after the cutoff; otherwise, it is negative. This reflects operational urgency rather than just exploitation existence.

2. Model Representations

ThreatLens evaluates two distinct representations of the cutoff-valid evidence:

• Evidence Text: A serialized representation of vulnerability context, severity summaries, EPSS values, advisory evidence, and relative temporal information.
• Structured Features: A tabular representation encoding EPSS scores/percentiles, CVSS base scores, advisory counts, exploit availability, CVE age, and interaction features (e.g., EPSS combined with exploit evidence).

3. Scoring Models

The framework trains and compares three types of rankers on the same data:

• Neural Text Ranker (TL-NR): Uses a BGE-large-en-v1.5 encoder with an MLP scoring head, trained with pairwise supervision (ranking a positive snapshot higher than a negative one from the same cutoff).
• Structured Logistic Ranker (TL-LR): A class-weighted logistic regression model trained on the structured tabular features.
• Shallow Text Ranker (TL-TF-IDF): A TF-IDF based logistic regression model trained on the evidence text.

4. Evaluation Protocol

The evaluation is designed to mimic deployment:

• Forward-in-Time Split: Data is split chronologically. Training, validation, and test sets are separated by time.
• CVE-Disjointness: CVEs appearing in the training set are excluded from validation and test sets to prevent identity leakage.
• Metrics: Performance is measured by Recall@K (specifically K=20 and K=50) within weekly candidate pools, reflecting the limited budget of security analysts. Global and macro PR-AUC are also reported to account for class imbalance.

Key Contributions

1. Problem Formulation: The authors formulate CVE prioritization as a periodic, time-aware ranking problem over weekly analyst review queues, moving beyond static severity scoring.
2. Data Construction: They introduce a method for constructing cutoff-aligned CVE snapshots that capture evolving public evidence while rigorously mitigating temporal leakage.
3. Framework Development: ThreatLens is presented as an evidence-guided framework that integrates multiple sources (NVD, EPSS, GHSA, Exploit-DB) and supports multiple ranking architectures (neural, structured, and shallow text).
4. Rigorous Evaluation: The paper provides a large-scale, forward-in-time, CVE-disjoint evaluation demonstrating that learned rankers significantly outperform standard baselines in identifying future KEV entries.

Results

Evaluated on a held-out test set containing 11,779 snapshots (2.50% positive rate), ThreatLens demonstrated substantial improvements over non-learned baselines:

• Top-K Prioritization: The structured logistic ranker (TL-LR) achieved 80.0% Recall@20 and 95.9% Recall@50. This is more than three times the performance of the EPSS baseline (24.7% Recall@20) and significantly outperforms CVSS and rule-based fusion.
• Model Efficiency: Contrary to the expectation that complex neural models would dominate, the lightweight, interpretable TL-LR (logistic regression on structured features) was the strongest aggregate scorer. This suggests that the value lies in the quality of the cutoff-aligned evidence representation rather than model complexity.
• Early Warning: ThreatLens can surface future KEV CVEs before their official entry date. In the strict forward-time setting, TL-LR identified 97.8% of held-out KEV CVEs in the top 50 before they entered the KEV catalog, with a median warning time of 25 days.
• Ablation Studies: Removing dominant signals like EPSS or CVSS from the models reduced performance but did not eliminate the advantage over baselines. This confirms that ThreatLens benefits from the integration of multiple evidence sources rather than relying on a single shortcut signal.

Significance and Claims

The paper claims that ThreatLens demonstrates that vulnerability prioritization should be treated as an operational early-warning problem rather than a static severity-ranking task.

• Deployment Realism: The primary contribution is not a novel neural architecture, but a deployment-realistic formulation that enforces temporal discipline. By ensuring models are trained and evaluated only on evidence available at decision time, the paper establishes a stronger standard for future exploitation-prediction systems.
• Complementary Signals: The results indicate that while EPSS and CVSS are useful, they are insufficient alone. The integration of structured signals (like EPSS movement and exploit availability) with textual context (advisory language and vulnerability descriptions) provides a robust signal for prioritization.
• Triage Compression: ThreatLens is positioned not as an autonomous remediation oracle, but as a triage compression layer. It reduces large weekly CVE pools into smaller, evidence-backed review queues, allowing analysts to focus their limited resources on vulnerabilities showing emerging operational risk before they are broadly recognized as urgent.
• Limitations: The authors modestly note that KEV is a weak proxy for exploitation (reflecting cataloging decisions and reporting practices, not just exploitation) and that the system estimates global relevance rather than organization-specific risk. Future deployment would require combining ThreatLens with local asset exposure and patch status.