AegisGuard: A Context-Aware Framework for Semantic Vulnerability Detection and Risk Stratification

The growing complexity of cyber threats has exposed the limitations of traditional vulnerability assessment tools, which primarily rely on static scanning and CVSS-based scoring. These approaches often fail to capture dynamic configurations and evolving threat surfaces in enterprise environments. To address this gap, we present AegisGuard, a context-aware framework for automated vulnerability detection and adaptive risk stratification. AegisGuard integrates structured system telemetry, semantic threat intelligence through retrieval-augmented generation (RAG), and a specialized large language model (LLM) to infer CVE applicability and assign five-level risk labels (L0–L4) that reflect both technical severity and environmental context. Unlike conventional scanners, AegisGuard dynamically adjusts its reasoning to system-specific privilege settings, exposure levels, and service criticality, enabling the identification of both critical exploits and subtle misconfigurations often missed by static tools. Our evaluation spans heterogeneous Linux and Windows platforms and leverages a dual-layer ground truth methodology: Core Ground Truth (C-GT) for verified vulnerabilities and Extended Ground Truth (E-GT) for semantically related threats. Results show that AegisGuard achieves an F1 score of up to 0.79 in CVE detection and exceeds 90% classification accuracy within a ±1 risk margin. Complementary ablation and prompt sensitivity analyses confirm the importance of RAG-based enrichment and structured input design in maximizing LLM effectiveness. Overall, these findings demonstrate that semantic, context-aware modeling is essential for accurate, scalable, and operationally relevant vulnerability management.