Centrality-Guided Config Prioritization

• Centrality-guided configuration prioritization is a method that uses graph-theoretic metrics to identify and rank the system's most critical configurations.
• It involves constructing graphs from system data, computing metrics such as betweenness, eigenvector, and degree centrality, and aggregating scores to prioritize interventions.
• Applications range from software security and configuration analysis to network planning, demonstrating improved remediation efficacy and reduced complexity.

Centrality-guided configuration prioritization is a family of methods that exploits centrality metrics derived from graph-theoretic models to focus analysis, remediation, or exploration efforts on the most structurally significant configurations within a system. These approaches have been instantiated across software security, combinatorial program analysis, resilient infrastructure design, and network modeling, typically using directed or undirected graphs in which nodes or edges correspond to system components, data flows, links, or features. Centrality-guided prioritization is underpinned by the intuition that strategically intervening in or examining structural chokepoints and high-impact subsystems amplifies remediation efficacy, analytical coverage, or resilience.

1. Graph-Theoretic Foundations and Centrality Metrics

Centrality-guided configuration prioritization universally requires representing a system as a graph or hypergraph in which nodes and/or edges have semantics aligned with the domain. The method then uses centrality metrics to rank components for prioritization.

In the context of configurable software or software security, such as with VIVID for SAST, a directed graph $G = (V, E)$ is constructed where nodes represent code units (files, modules, features), and directed edges model data- or control-flow relationships, often weighted by the number of impacted flows or the presence of tainted data (Budhwani et al., 22 May 2025, Bruzzone et al., 22 Jan 2026). Representative centrality metrics include:

• Betweenness Centrality: $$C_B(v) = \sum_{s\ne v \ne t} \frac{\sigma_{st}(v)}{\sigma_{st}}$$, quantifying the fraction of shortest $s \to t$ paths passing through node $v$.
• (In/Out-)Eigenvector Centrality: For adjacency $A$, out-eigenvector centrality solves $\lambda v^{out} = A v^{out}$; in-eigenvector, $\lambda v^{in} = A^\top v^{in}$.
• Degree Centrality: $D^+(v) = \sum_u A_{v, u}$ (out-degree), $D^-(v) = \sum_u A_{u, v}$ (in-degree).
• PageRank: Computes recursively, capturing network influence propagation.
• Cross-Clique Connectivity: $X(v)$ is the number of maximal cliques a node belongs to, relevant for nodes spanning multiple vulnerability clusters (Budhwani et al., 22 May 2025).

In infrastructure and road networks, link betweenness centrality is computed for edges to determine critical connectivities (Kays et al., 2024).

2. Methodologies for Prioritization

The core methodology proceeds in the following stages:

1. Graph Construction: Derive an appropriate graph (data flow, feature dependency, road topology) from the domain artifact—e.g., SAST output, program IR, or transportation infrastructure.
2. Metric Computation: Calculate one or more centrality metrics over the constructed graph. For large graphs, Brandes’ algorithm is used for efficient betweenness calculation with time complexity $O(|V||E|)$ (Kays et al., 2024).
3. Score Aggregation: Normalize and, if relevant, combine metrics into a composite prioritization score using min–max scaling, machine-learned weights (ridge regression in MCDA frameworks (Kays et al., 2024)), or domain-tuned weight vectors (Budhwani et al., 22 May 2025).
4. Ranking: Rank configurations, features, files, or links by their aggregated scores.
5. Selection or Remediation: Select top-$k$ elements for focused analysis, patching, or intervention.

In configuration explosion for software, RustyEx illustrates an end-to-end flow: compiler-extracted intermediate representation, dual graph construction (feature dependency and atom dependency), centrality computation (user-specified), code-impact refinement, and SAT-based enumeration of compliant top-ranked configurations (Bruzzone et al., 22 Jan 2026).

3. Applications Across Domains

Software Security (SAST Remediation)

The VIVID methodology constructs Vulnerability Data Flow (VDF) graphs from SAST output and prioritizes files for security control insertion based on centrality. Empirically, betweenness and cross-clique metrics captured 100% of ideal controller locations for input-validation remediation in WebGoat and VeraDemo. Out-degree and out-eigenvector centrality were associated with propagators requiring refactoring, whereas in-degree and PageRank marked data sinks (Budhwani et al., 22 May 2025).

Software Configuration Analysis

In RustyEx, centrality-guided prioritization addresses the infeasibility of exhaustively exploring all valid feature configurations in Rust codebases. Features are ranked structurally and semantically; then, the $k$ most central and code-impactful features are selected, and configurations that enable these features are generated with SAT-solvers, guaranteeing semantic validity. Empirical analysis of 40 Rust projects showed that this approach dramatically reduced the configuration space while maintaining analyzability and soundness by construction (Bruzzone et al., 22 Jan 2026).

Network and Infrastructure Planning

In transportation networks, link betweenness centrality quantifies redundancy and vulnerability. A brute-force approach enumerates feasible directionality scenarios; for each, total betweenness centrality (TBC), total link traffic flow (TLTF), and system travel time (STT) are measured. A ridge regression–driven MCDA then implicitly prioritizes scenarios minimizing TBC, maximizing TLTF, and minimizing STT, targeting both efficiency and redundancy. Case studies show TBC-targeted interventions can restore resilience post-disaster (Kays et al., 2024).

Network Ensemble Modeling

Layered configuration models in network science use centrality (onion/k-core layer) to constrain random graph ensembles, optimizing model complexity via the minimum description length principle. Empirical studies show that the layered model outperforms the classic configuration model, especially for sparse real-world networks, due to its ability to shrink the graph ensemble via centrality-induced local constraints (Hébert-Dufresne et al., 2022).

4. Algorithmic and Formal Guarantees

Many centrality-guided frameworks provide detailed pseudocode or formalized algorithms:

• SAST Remediation (VIVID): Iterates metric computation, normalization, and weighted scoring to prioritize files. Composite scores admit tunable weights, supporting security posture customization. The framework is readily automatable within CI pipelines, and integration with ticketing/reporting is straightforward (Budhwani et al., 22 May 2025).
• SAT-Backed Configuration Enumeration: In RustyEx, refined rankings are used as heuristics for SAT-based configuration selection, with explicit construction of CNF formulas ensuring soundness. The enumeration process is formally correct—every output configuration satisfies all feature dependencies and logical predicates (Bruzzone et al., 22 Jan 2026).
• MDL Model Selection: In network modeling, model selection via the minimum description length guarantees the most parsimonious representation, providing an optimality criterion for choosing centrality-aware versus degree-only ensemble constraints (Hébert-Dufresne et al., 2022).

5. Empirical Findings and Comparative Insights

Empirical studies highlight the efficacy and trade-offs of centrality-guided configuration prioritization:

Domain	Graph Metric(s)	Outcome/Effectiveness
SAST Remediation	Betweenness, Cross-clique, Degree	100% capture of ideal input-validation sites; effective flagging of broad-impact files (Budhwani et al., 22 May 2025)
Software Configuration	Degree, Betweenness, Eigenvector (Feature-DG); code-impact boost	~93% project analysis success rate; substantial reduction in configuration set size (Bruzzone et al., 22 Jan 2026)
Road Network Resilience	Link Betweenness (TBC)	TBC-guided interventions sharply reduce system travel time after perturbations (Kays et al., 2024)
Network Model Selection	Onion (k-core) Layer	LCM best in 62% of domains, 88% in sparse; outperformed by classic CM in very dense graphs (Hébert-Dufresne et al., 2022)

A plausible implication is that centrality-driven prioritization is most valuable in sparse, hierarchical, or modular systems where critical paths or “chokepoints” exert outsize influence; in homogeneous or fully-connected systems, added complexity from centrality layering may not be justified.

6. Limitations and Future Directions

Limitations of centrality-guided configuration prioritization include:

• Metric Proxy Limitations: Centrality measures are proxies for practical importance and may not identify semantically critical but structurally peripheral elements. For example, lightly connected features with significant domain logic may be underweighted (Bruzzone et al., 22 Jan 2026).
• Analytical Overhead: Normalization, multi-metric aggregation, and enumeration add computational cost, especially in massive graphs or configuration spaces.
• Domain Dependence: Some frameworks (e.g., RustyEx) deeply specialize to a language or toolchain; portability may require new extraction tools (Bruzzone et al., 22 Jan 2026).
• Coverage Guarantees: These methods provide prioritization, not coverage-optimality or completeness for bug-detection, resilience, or optimization objectives.

Future research directions include hybridizing static centrality with dynamic runtime traces, extending graph abstractions to higher-order or heterogeneous dependency types, integrating configuration prioritization with test coverage and security analytics, and generalizing centrality-guided models to additional domains.

7. Integration and Practical Deployment

Centrality-guided prioritization is intrinsically automatable and integrates cleanly with build and analysis pipelines:

• For SAST, centrality ranking can be triggered post-scan and fed into ticketing systems to action top-$k$ priorities, with weight tuning enabling organization-specific focus (e.g., chokepoints versus sinks) (Budhwani et al., 22 May 2025).
• The RustyEx workflow supports integration into CI for managed configuration exploration, with empirical scaling suitable for real-world development hours (Bruzzone et al., 22 Jan 2026).
• In transportation applications, intervention strategies derived from centrality metrics can be fed into decision support tools for scenario planning (Kays et al., 2024).
• The MDL-based selection in network ensemble modeling can be automated as a post-processing step in network analysis pipelines (Hébert-Dufresne et al., 2022).

By leveraging structural information captured through centrality, configuration prioritization enables focused, high-leverage interventions and analysis, offering mathematically justified decision support across diverse complex systems.