VulnPriority Risk Ranker

LightGBM LambdaRank model for CVE prioritization refinement within policy tiers.

Intended Use

• Refine vulnerability ordering within the same policy tier
• Complement (not replace) transparent policy-based ranking

Limitations

• Trained on synthetic/offline CVE corpus snapshot
• Not a substitute for live NVD API enrichment in production
• Does NOT use CVSS×EPSS as a scoring method

Training

• Temporal split: train < 2022-06, val < 2023-06, test ≥ 2023-06
• Objective: LambdaRank (NDCG)
• Features: cvss, epss, epss_percentile, kev_status, patch_available, asset_exposure, asset_criticality

By Aria AI Security Engineering Team.