RBVPF Empirical Evaluation Dataset and Reproducibility Package
Description
This dataset and reproducibility package accompanies the manuscript “Enterprise Context-Aware Vulnerability Prioritization: An Interpretable Framework for Remediation Decision-Making.” The study proposes and empirically evaluates the Risk-Based Vulnerability Prioritization Framework (RBVPF), an interpretable enterprise-oriented framework integrating Technical Severity (TS), Threat Context (TC), Asset Context (AC), Business Context (BC), and Control Effectiveness (CE). The empirical evaluation comprises two complementary studies. Study A reconstructs point-in-time CVSS and EPSS information for vulnerabilities published during 2023–2024 and evaluates a strict prospective cohort of 33,899 vulnerabilities against subsequent inclusion in the CISA Known Exploited Vulnerabilities (KEV) Catalog over 30-, 90-, 180-, and 365-day horizons. Study B evaluates enterprise-context decision behaviour across 67,025 vulnerabilities by systematically varying AC, BC, and CE, producing 10,053,750 controlled counterfactual evaluations. The package contains derived analysis datasets, data-quality information, source manifests, data-acquisition and historical-reconstruction scripts, the RBVPF implementation and end-to-end analysis workflow, reproduced empirical results, a data dictionary, and documentation mapping the computational outputs to the results reported in the manuscript. The underlying vulnerability and threat information originates from publicly available sources including the National Vulnerability Database (NVD), the CVE Program/CVEProject, FIRST EPSS, and the CISA KEV Catalog. Enterprise-context conditions used in Study B are controlled experimental inputs and do not represent confidential or observed organizational data. The package is intended to support transparency, verification, and reproduction of the empirical analyses reported in the accompanying manuscript.
Files
Steps to reproduce
Download and extract RBVPF_Reproducibility_Package_v1.0.zip. Consult README.md for the package structure, software requirements, data provenance, and reproduction workflow. DATA_DICTIONARY.md describes the principal variables and datasets, while the source manifests document acquisition and point-in-time reconstruction of the underlying public vulnerability and threat information. Install the Python dependencies specified in the package requirements file and execute the end-to-end reproduction script according to the instructions in README.md. The workflow reconstructs the Study A analysis cohorts and subsequent-KEV outcomes, reproduces workload-matched CVSS, EPSS, and RBVPF TS–TC analyses, performs the Threat Context sensitivity and temporal holdout analyses, and regenerates the Study B standardized-context and full-factorial evaluations. Generated outputs can be compared with the supplied reproduced-results files and VERIFICATION.md. MANUSCRIPT_RESULT_MAP.md maps computational outputs to the corresponding empirical results reported in the accompanying manuscript. Historical source acquisition/reconstruction scripts are also included for researchers wishing to reconstruct the analytical inputs from the original public sources. Because these sources are externally maintained and may change over time, the included derived datasets and manifests should be used when reproducing the exact results reported in Version 1 of this dataset.