Topology-Aware Vulnerability Prioritization on Automated Attack Graphs from Infrastructure-as-Code

Contemporary vulnerability management relies on the Common Vulnerability Scoring System (CVSS) and the Exploit Prediction Scoring System (EPSS), both of which evaluate Common Vulnerabilities and Exposures (CVE) entry in isolation, disregarding the network topology in which vulnerable components operate. We present the Dynamic Security Resistance Distance (DSRD) framework, which parses Docker Compose, GNS3, and Containerlab configuration files into weighted attack graphs where edge conductance reflects EPSS exploitability. A version-aware filtering stage matches discovered CVEs against the software versions declared in container image tags, reducing version-irrelevant CVE matches by up to 97%. Kirchhoff effective resistance, computed via the Moore-Penrose pseudoinverse of the graph Laplacian, yields a structural compromise affinity—a monotone score guaranteed not to increase upon patching. Four algorithms—Ant Colony Optimization, Physarum, Fungal Network Growth, and Greedy Kirchhoff-rank vulnerabilities by their structural impact on network-wide risk. Evaluation on nine representative topologies derived from public IaC artifacts, spanning six Docker Compose and three GNS3 deployments, with 895 version-relevant vulnerability nodes from cvelistV5 shows that graph-aware prioritization reduces structural risk by up to 5.62×10−2 after ten patches, whereas EPSS-only ordering achieves at most 1.28×10−2 on the same topology. EPSS-only targets high-probability CVEs on entry points that do not lie on critical paths; graph-aware methods instead prioritize CVEs on high-resistance paths toward critical assets. The advantage depends on infrastructure heterogeneity and topology structure: topologies with diverse vendors and well-defined structural bottlenecks benefit most, while densely connected or homogeneous environments show marginal improvement. We release the full pipeline as open-source software.