An AI-Enhanced Risk-Based Vulnerability Prioritization Framework for Enterprise Information Systems

Author: Lord Kingsley Baffoe
Affiliation: MSc Computer Science with Cybersecurity, St Mary's University, Twickenham, London, United Kingdom
Email: 2416509@live.stmarys.ac.uk | baffoe6@gmail.com
Target Journal: Journal of Information Security and Applications (JISA)
Repository: github.com/Baffoe6/Intelligent_Vulnerability_Prioritization_Using_AI_in_Enterprise_Information_Systems

A reproducible cybersecurity research project that develops and evaluates an AI-enhanced vulnerability prioritization framework for enterprise information systems. The framework combines publicly available vulnerability intelligence (NVD, EPSS, and CISA KEV) with enterprise-risk context to improve vulnerability prioritization beyond traditional CVSS-based approaches.

Official results are derived from the final NVD year-feed experiment (2015–2025). An earlier exploratory API-only experiment is excluded from all reported findings.

Publication Status

Status: Submission Ready

Target Venue: Journal of Information Security and Applications (JISA)

Research Areas:

• Cybersecurity
• Vulnerability Management
• Artificial Intelligence
• Machine Learning
• Enterprise Information Systems
• Risk-Based Security Analytics

Key Findings

• XGBoost achieved a ROC-AUC of 0.985 and F1 score of 0.867 on the official evaluation dataset.
• The proposed framework improved Top-100 vulnerability prioritization precision from 0.37 (CVSS-only) to 0.99.
• Temporal validation maintained strong predictive performance (ROC-AUC 0.983) on previously unseen 2024–2025 vulnerabilities.
• SHAP analysis identified EPSS score, EPSS percentile, vulnerability age, attack vector, and privileges required as the most influential predictors.
• The framework matched EPSS at Top-100 prioritization and outperformed EPSS at Top-500 prioritization, demonstrating value from combining exploit prediction with additional vulnerability and enterprise-risk context.

Official Metrics

Item	Value
Dataset	356,503 CVEs (NVD year feeds, 2015–2025)
Positive class	1,623 CISA KEV exploited CVEs
Balanced training set	9,738 records (5:1 negative sampling)
Best model	XGBoost
ROC-AUC	0.985
F1 Score	0.867
Recall	0.923
Top-100 precision (AI / CVSS)	0.99 / 0.37
Lift	2.7×

Repository Structure

src/                            Source code
paper/                          Manuscript and submission materials
results/figures/                Publication figures
results/tables/                 Evaluation tables
notebooks/                      Exploratory notebooks

run_pipeline.py                 End-to-end experiment pipeline
run_temporal_validation.py      Future-year validation
run_baseline_comparison.py      CVSS / EPSS / XGBoost comparison
run_shap_analysis.py            Explainability analysis

README.md
CITATION.cff
LICENSE
requirements.txt

Data: Real vs Simulated

Component	Source	Used as
NVD CVSS metrics, CVE metadata	NVD year feeds	Real input features
EPSS scores	FIRST EPSS	Real input features
CISA KEV	CISA catalogue	Real target label only
Asset criticality, internet exposure, business impact	Seeded simulation	Simulated input features

Leakage prevention: kev_listed and KEV-derived flags are excluded from model features. KEV defines exploited only.

Reproducibility Commands

pip install -r requirements.txt
python run_pipeline.py              # Full run: downloads NVD year feeds (2015–2025), trains models
python run_temporal_validation.py
python run_baseline_comparison.py
python run_shap_analysis.py

If you already have local raw/processed data from a prior run:

python run_pipeline.py --skip-download

Raw NVD feeds (~3 GB) and the combined JSON cache are not stored in this repository. They are downloaded automatically on the first full pipeline run. Large intermediates (vulnerability_dataset.csv, temporal splits) are regenerated locally and listed in .gitignore.

Equivalent SHAP entry point: python -m src.shap_analysis

Re-evaluate saved models only: python -m src.evaluate_models (via pipeline --models-only path in run_pipeline.py).

Fixed random seed: 42 (src/config.py). Experiment ID: nvd_year_feeds_2015_2025.

JISA Submission

Manuscript, cover letter, figures, and tables live under paper/ and results/. See paper/JISA_SUBMISSION_GUIDE.md before uploading to https://www.editorialmanager.com/JISAS

Academic Paper

Document	Path
Full manuscript (Markdown)	paper/draft.md
LaTeX manuscript (JISA)	paper/manuscript.tex
JISA submission notes	paper/JISA_SUBMISSION_NOTES.md
Journal abstract	paper/abstract.md
Cover letter	paper/cover_letter.md
Data availability	paper/data_availability_statement.md
Suggested reviewers	paper/suggested_reviewers.md
Reviewer submission notes	paper/reviewer_submission_notes.md

Research Disclaimer

This repository is an academic research artefact, not a production security product. Simulated enterprise features must be replaced with organisational asset data before operational deployment. KEV labels reflect CISA-catalogued exploitation, not exhaustive ground truth. Balanced training requires threshold recalibration for live feeds. No warranty — see MIT License.

Citation

@misc{baffoe2026intelligent_vuln_prioritization,
  author       = {Baffoe, Lord Kingsley},
  title        = {Intelligent Risk-Based Vulnerability Prioritization Using {AI} in Enterprise Information Systems},
  year         = {2026},
  howpublished = {\url{https://github.com/Baffoe6/Intelligent_Vulnerability_Prioritization_Using_AI_in_Enterprise_Information_Systems}},
  note         = {Official results: ROC-AUC 0.985, Top-100 precision 0.99 vs CVSS 0.37}
}

Also see CITATION.cff for machine-readable metadata.

License

MIT License — see LICENSE.