Source-linked AI summary
VPID: An Integrated Framework for Vulnerability Prioritization and Intrusion Detection in Enterprise Networks
Xuanren Chen, Xin Wang, Xiaoqi Li
TL;DR
Small enterprises need security mechanisms that fit limited budgets, computing resources, and specialist staff. VPID responds with an integrated framework linking vulnerability prioritization and controlled validation to lightweight traffic detection, rule verification, and automated response. The reported evaluation achieved 91.8% precision, 89.5% recall, and 90.6% F1 for vulnerability prioritization, while the integrated workflow supports interpretable review but remains bounded by encrypted-traffic visibility, scanner coverage, dataset differences, and centralized throughput.
Problem
Small enterprises require vulnerability prioritization and intrusion detection that operate with limited budgets, computing resources, specialist staff, and manual intervention.
Method
VPID links OpenVAS discovery, context-aware decision-tree prioritization, controlled validation, Scapy traffic analysis, multinomial Naive Bayes, Snort verification, and iptables response.
Results
91.8% precision, 89.5% recall, and 90.6% F1 were achieved for vulnerability prioritization, while the proposed detector outperformed Snort in precision and recall by 6.3 and 8.8 percentage points, respectively.
Takeaways & Limitations
Lightweight and interpretable models can support an integrated security workflow with explicit decision paths, rule-matching evidence, and response records for operator review.
Takeaways & Limitations
The evaluation is bounded by encrypted-traffic visibility, OpenVAS test-feed coverage, distribution differences among combined datasets, adversarial traffic, and centralized throughput constraints.
Abstract
from arXiv · showhide
Small enterprises face increasingly serious threats to their internal networks but often lack the financial resources, computing capacity, and specialist staff required to deploy resource intensive security platforms. This paper designs and implements VPID, a lightweight framework for vulnerability prioritization and intrusion detection that consists of two principal modules: controlled vulnerability validation and intelligent intrusion defense. The first module uses OpenVAS for asset mapping and vulnerability identification, applies a decision tree to prioritize vulnerabilities, and employs a rule engine to generate targeted validation payloads. The second module captures network traffic using Scapy, analyzes it through a detection pipeline that combines a decision tree with multinomial Naive Bayes, verifies traffic assessed as high risk using Snort rules, and performs blocking and alerting through iptables. The evaluation uses 550,000 network flow samples containing normal and attack traffic for detector training, together with 15,000 labeled vulnerability records. On the vulnerability ranking test set, the decision tree achieves a precision of 91.8%, a recall of 89.5%, and an F1 score of 90.6%. On an independent test set containing 55,000 traffic samples, the combined detection pipeline achieves a precision of 94.5%, a recall of 88.3%, and an F1 score of 91.3%, while maintaining a false positive rate below 1.5%.
1 Introduction
VPID addresses small-enterprise security constraints by unifying context-aware vulnerability prioritization with lightweight intrusion detection and automated response. Its design combines interpretable models with operational validation and enforcement mechanisms.
- Motivation: Small enterprises need to direct limited remediation resources toward high-risk vulnerabilities while detecting and containing attacks on low-end hardware.The stated requirements emphasize lightweight operation, interpretability, and limited manual intervention.
- Motivation: CVSS severity alone is insufficient for remediation priority because practical risk also depends on asset value, exposure, exploitability, temporal factors, and organizational context.These factors motivate context-aware prioritization rather than severity-only ranking.
- Framework: VPID unifies vulnerability discovery, context-aware prioritization, controlled validation, traffic detection, rule verification, and automated response.The framework is proposed specifically to connect model-level analysis with an operational security workflow.
- Framework: The vulnerability-prioritization method combines CVSS with deployment and organizational risk factors, using a CART model to produce interpretable priority labels and risk scores.Inputs include exploitability, asset and business value, network exposure, patch status, exploitation history, and confidence.
- Framework: The intrusion-defense pipeline combines decision-tree screening, multinomial Naive Bayes, Snort verification, and iptables enforcement while targeting deployment efficiency and interpretability.The framework is implemented as four coordinated Docker services and evaluated with 15,000 vulnerability records, 550,000 traffic-training samples, and 55,000 independent traffic samples.
2 Technical Background
The technical background establishes OpenVAS and CVSS-based vulnerability processing, decision-tree principles, multinomial Naive Bayes classification, and Scapy-based traffic feature extraction for lightweight security analysis.
- 2.1 Vulnerability scanning: OpenVAS scans configured hosts and services, returning structured vulnerability records for downstream risk analysis.Reports include affected hosts, ports, identifiers, severity scores, descriptions, and remediation recommendations.
- 2.1 Vulnerability scanning: CVSS severity is treated as one prioritization input alongside deployment-specific operational risk factors.The prototype uses CVSS v3.1 severity bands while remediation targets remain configurable policies.
- 2.2 Naive Bayes: Multinomial Naive Bayes models nonnegative feature vectors and is selected for efficient classification of high-dimensional, sparse representations.Its conditional-independence assumptions are approximate for correlated traffic features, but it provides interpretable class scores.
- 2.3 Decision trees: Decision trees recursively partition data into more homogeneous subsets, while CART selects binary splits by minimizing weighted Gini impurity.CART pruning adds a complexity penalty to reduce overfitting and preserve useful decision boundaries.
- 2.4 Traffic processing: Scapy captures and dissects packets, which VPID groups into sessions and converts into statistical, protocol, and application-layer features.Plaintext payloads use TF–IDF features, whereas encrypted traffic relies on flow metadata and statistical characteristics.
3 System Architecture
VPID organizes scanning, machine-learning analysis, defense execution, and presentation into a layered architecture with standardized component interfaces.
- 3 System Architecture: The system manages assets and scan histories, invokes OpenVAS, ranks vulnerabilities, and generates validation payloads for high-risk findings.Its defense path captures traffic with Scapy, applies machine learning, verifies suspicious traffic with Snort, and blocks confirmed malicious sources.
- 3 System Architecture: VPID separates data acquisition, processing, machine-learning analysis, defense execution, and presentation into five architecture layers.Standardized interfaces allow scanners, models, rules, and storage to evolve independently.
4 Vulnerability Prioritization and Validation
VPID ranks vulnerabilities through a traceable discover–assess–validate workflow, combining structured risk features, decision-tree prioritization, and controlled rule-based validation.
- Workflow: The module retrieves and preprocesses OpenVAS reports before estimating vulnerability priority and generating validation rules.The workflow removes duplicates and invalid fields, normalizes records, executes controlled checks, and writes results back.
- Priority model: Priority is classified as high, medium, or low using CART features covering severity, exploitability, asset value, exposure, patch status, exploitation history, and confidence.Categorical fields are encoded separately, while descriptions contribute extracted keywords.
- Controlled validation: JSON templates generate parameterized validation payloads for SQL injection, cross-site scripting, command injection, and file inclusion.The engine substitutes target-specific values, applies escaping and retry logic, and ranks candidate templates by match results and empirical weights.
- Controlled validation: The highest-scoring validation rule is executed in a controlled environment, while the module records rather than assumes exploitability.This preserves a distinction between vulnerability prioritization and validation outcome.
- Priority model: The assessment algorithm sorts vulnerabilities by comprehensive risk score after producing priority labels.The score combines encoded vulnerability and asset attributes, including exposure, patch status, history, and confidence.
5 Attack Detection and Response
VPID reconstructs bidirectional sessions, represents them with metadata and payload features, and applies staged classification, rule verification, risk fusion, and response thresholds.
- Traffic processing: Online and offline traffic share session reconstruction and feature extraction, although online data support real-time response and offline data support training and evaluation.Online traffic is captured from selected interfaces, while offline traffic includes locally collected and public attack samples.
- Traffic processing: Sessions are formed from normalized bidirectional five-tuples and split when packet inactivity exceeds threshold τ.Duplicate and malformed packets are removed, and endpoint order is normalized before grouping.
- Feature representation: Each session combines statistical and protocol metadata with TF–IDF payload features and character trigrams.The representation uses 12 metadata dimensions, 100 TF–IDF dimensions, and 50 character-three-gram dimensions.
- Two-stage detection: The decision tree screens compact metadata first, while multinomial Naive Bayes analyzes TF–IDF and trigram features for sessions requiring further analysis.This separation reserves payload-oriented classification for suspicious sessions instead of applying it to every input.
- Response: The fused risk score combines decision-tree suspicion, Naive Bayes confidence, and Snort rule evidence before mapping traffic to logging, alerting, or blocking.Thresholds distinguish high-risk blocking, medium-risk manual review, and low-risk logging without active response.
6 Implementation and Deployment
VPID is implemented as a lightweight service stack and evaluated in a dedicated internal topology that observes scanning, validation, detection, and response.
- System implementation: The implementation uses two CPU cores, 4 GB of memory, and a 40-GB disk for the development and test host.The stack includes Python, scikit-learn, MySQL, a lightweight web framework, OpenVAS integration, Scapy capture, and iptables enforcement.
- Deployment environment: A dedicated topology separates the vulnerable target, defense server, and test terminal.The test terminal issues controlled scans, validation requests, and attack traffic against the target through the defense server.
- Evaluation setup: The experiment calibrates the multinomial Naive Bayes smoothing parameter within the controlled network environment.The source experiment selects α = 1.0 and retains the reported values in table 2.
7 Evaluation
VPID is evaluated on harmonized traffic and vulnerability datasets using operational metrics, model comparisons, and deployment measurements. The decision tree improves substantially over CVSS-only ranking, while the combined detector balances attack detection with low false positives and lightweight resource use.
- Datasets and metrics: 15,000 vulnerability records combine CVSS with asset, exposure, patch, exploitation-history, and confidence features for High, Medium, and Low priority classes.Medium-priority records comprise half of the vulnerability dataset.
- Datasets and metrics: 91.8% precision is reported for vulnerability prioritization, while attack detection is evaluated with precision, recall, F1 score, and false positive rate rather than accuracy.The metrics reflect different operational consequences, including alert reliability, missed attacks, and benign-traffic disruption.
- Vulnerability ranking: 90.6% F1 is achieved by the decision tree, while random forest scores 1.4 percentage points higher in precision and F1 and 1.3 points higher in recall.The comparison weighs ensemble performance against the decision tree’s interpretability.
- Vulnerability ranking: 15.7 percentage points higher F1 over the CVSS-only baseline shows the decision tree benefits from contextual prioritization features.The decision tree is selected over the slightly stronger random forest because it preserves explicit decision paths and simpler inspection.
- Attack detection: 94.5% precision, 88.3% recall, and a 1.2% false positive rate are achieved on the independent traffic test set, with 1,191 attacks missed.The pipeline combines decision-tree screening, multinomial Naive Bayes, Snort verification, and iptables enforcement.
- Response time and resource use: 280 ms mean end-to-end defense time and below-15% CPU utilization are reported on the two-core, 4-GB host, while scanning 100 IP addresses averages 28 minutes.Mean model-detection latency is 65 ms, and memory consumption is approximately 800MB.
- Limitations: Encrypted payloads, OpenVAS test-feed coverage, combined-dataset distribution differences, adversarial traffic, and centralized throughput constrain the evaluation and deployment scope.These limitations leave some HTTPS attacks invisible and may reduce generalization to substantially larger production networks.
8 Conclusion and Future Work
The conclusion presents VPID as an integrated, lightweight workflow connecting vulnerability management with intrusion detection and automated response. Reported results support interpretable operation on modest hardware, while future work targets encrypted traffic, robustness, generalization, and scalability.
- Conclusion: 91.8% precision, 89.5% recall, and 90.6% F1 are achieved on 15,000 vulnerability records using OpenVAS, CART prioritization, and rule-based validation.The workflow connects vulnerability discovery, contextual ranking, controlled validation, and response-related processing.
- Conclusion: VPID combines metadata and payload features with decision-tree screening, multinomial Naive Bayes, Snort verification, and iptables enforcement for intrusion detection and response.The framework is designed for resource-constrained small-enterprise networks.
- Limitations and future work: Evaluation remains limited by encrypted-traffic visibility, OpenVAS feed coverage, dataset distribution differences, and centralized deployment throughput constraints.Future work proposes TLS fingerprints, temporal flow features, adversarial evaluation and training, lightweight ensembles, and distributed traffic collection.