# VulRG: Multi-Level Explainable Vulnerability Patch Ranking for Complex Systems Using Graphs

arXiv: https://arxiv.org/abs/2502.11143 · HTML: https://mlsanity.com/paper/2502.11143/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 Feb 2025.

## Built on by (most cited first, 3 of 3)

- [Multi-Agent Framework for Threat Mitigation and Resilience in AI-Based Systems](https://mlsanity.com/paper/2512.23132/) (2025)
- [CyGATE: Game-Theoretic Cyber Attack-Defense Engine for Patch Strategy Optimization](https://mlsanity.com/paper/2508.00478/) (2025)
- [RiskBridge: Turning CVEs into Business-Aligned Patch Priorities](https://mlsanity.com/paper/2601.06201/) (2026)

## Abstract (arXiv)

As interconnected systems proliferate, safeguarding complex infrastructures against an escalating array of cyber threats has become an urgent challenge. The increasing number of vulnerabilities, combined with resource constraints, makes addressing every vulnerability impractical, making effective prioritization essential. However, existing risk prioritization methods often rely on expert judgment or focus solely on exploit likelihood and consequences, lacking the granularity and adaptability needed for complex systems. This work introduces a graph-based framework for vulnerability patch prioritization that optimizes security by integrating diverse data sources and metrics into a universally applicable model. Refined risk metrics enable detailed assessments at the component, asset, and system levels. The framework employs two key graphs: a network communication graph to model potential attack paths and identify the shortest routes to critical assets, and a system dependency graph to capture risk propagation from exploited vulnerabilities across interconnected components. Asset criticality and component dependency rules systematically assess and mitigate risks. Benchmarking against state-of-the-art methods demonstrates superior accuracy in vulnerability patch ranking, with enhanced explainability. This framework advances vulnerability management and sets the stage for future research in adaptive cybersecurity strategies.