Organizations struggle to handle sheer number of vulnerabilities in their
cloud environments. The de facto methodology used for prioritizing
vulnerabilities is to use Common Vulnerability Scoring System (CVSS). However,
CVSS has inherent limitations that makes it not ideal for prioritization. In
this work, we propose a new way of prioritizing vulnerabilities. Our approach
is inspired by how offensive security practitioners perform penetration
testing. We evaluate our approach with a real world case study for a large
client, and the accuracy of machine learning to automate the process end to
end.

本文介绍了一种新的漏洞优先级排序方法，受渗透测试的启发，通过一个真实的案例来验证了机器学习自动化流程的准确性。

漏洞优先级排序：一种攻击性安全方法

Vulnerability Prioritization: An Offensive Security Approach

We consider the problem of controlling a partially-observed dynamic process
on a graph by a limited number of interventions. This problem naturally arises
in contexts such as scheduling virus tests to curb an epidemic; targeted
marketing in order to promote a product; and manually inspecting posts to
detect fake news spreading on social networks.
We formulate this setup as a sequential decision problem over a temporal
graph process. In face of an exponential state space, combinatorial action
space and partial observability, we design a novel tractable scheme to control
dynamical processes on temporal graphs. We successfully apply our approach to
two popular problems that fall into our framework: prioritizing which nodes
should be tested in order to curb the spread of an epidemic, and influence
maximization on a graph.

考虑通过有限的干预来控制动态过程。我们将这个问题表述为关于时间图过程的顺序决策问题，并设计了一个新颖的可行方案来控制时间图上的动态过程。我们成功地将方法应用于两个流行问题：优先考虑哪些节点进行检测以限制疫情传播，以及影响最大化问题。