A Context-Aware XGBoost Framework for Vulnerability Remediation Recommendation Using GitHub Security Advisories

Severity alone is an unreliable measure for vulnerability remediation decisions as there are also operational response factors based on software ecosystem, advisory, and textual context. In this paper, a context-aware framework of remediation recommendation is proposed that is derived from GitHub Security Advisories (GHSA). The framework consists of three priorities of operation: Immediate Patch, Scheduled Patch and Monitor, based on deterministic rulebased policy, learns to approximate these priorities from contextual information, and withholds variables that generate labels from the predictive feature set. This creates a set of 2,417 instances of vulnerabilities, 2,195 Scheduled Patch, 135 Monitor and 87 Immediate Patch. The problems of severe class imbalance are solved by providing accuracy, balanced accuracy, weighted-F1, macro-F1 and class-wise metrics. Fivefold stratified evaluation shows that XGBoost achieves 86.88% ± 0.95% accuracy, 0.5563 ± 0.0316 balanced accuracy, 0.8694 ± 0.0064 weighted-F1, and 0.5270 ± 0.0218 macro-F1. For the minority-class the results of Immediate Patch and Monitor are significantly poorer than those for Scheduled Patch. The weighted F1 of the Full Non-Leaky Context is 0.8727 from the results of the ablation test. SHAP analysis reveals that the predictive signal that is dominant is semantic information. Results confirm the context heterogeneity and reveal rulederived labels and difficulty of minority classes as major limitations.