Predicting Affected Docker Images From Emerging Vulnerabilities With a Tripartite Graph

Containerization is widely adopted across modern software systems, but it also increases exposure to a growing number of security vulnerabilities. While traditional vulnerability scanners remain effective, they face limitations in scalability and responsiveness, particularly when dealing with newly disclosed CVEs. To address these challenges, we propose a graph-based framework that models container images, installed packages, and vulnerabilities as a tripartite graph. Leveraging graph-based link prediction methods, our approach predicts links from newly emerged vulnerability nodes to potentially affected images by capturing structural and semantic patterns in the graph. To enhance generalization in cold-start scenarios, we apply BERT-based feature augmentation to encode the textual descriptions of emerging vulnerabilities, and construct pseudo-edges using cosine similarity to connect them to semantically relevant nodes. We evaluate the framework under two realistic cold-start scenarios designed to simulate varying levels of prior knowledge. Experimental results show that our method achieves high Precision@kscores even in sparse and imbalanced conditions, demonstrating strong predictive capability for previously unseen vulnerabilities. This enables rapid image–CVE mapping, improves resource efficiency, and supports early alerting, offering a lightweight and scalable complement to traditional static analysis tools.