# Attack Surface Score for Software Systems
## 3 Methodology
### Metrics Quantification
#### 3.3.5 Attack Surface Metric  
For each vulnerability, we have already computed both its damage potential and the effort required to exploit it. To synthesize these into a single metric, we note that higher damage potential indicates a more severe (stronger) attack, whereas greater required effort corresponds to a less likely (weaker) attack ([PERSON], 2013). Therefore, the contribution of each issue can be expressed as  
\[Contribution\propto DamagePotential \tag{3}\]  
\[Contribution\propto\frac{1}{Effort} \tag{4}\]  
Combining these relationships yields  
\[Contribution=\frac{ DamagePotential}{Effort} \tag{5}\]  
The overall attack surface score for a codebase is the sum of the contributions across all issues as shown in Equation (6):  
\[\text{AttackSurfaceScore}=\sum_{i=1}^{N}\frac{\text{DamagePotential}_{i}}{ \text{Effort}_{i}} \tag{6}\]  
To enable comparisons between different codebases, we normalize the aggregate score. This normalization is based on the theoretical maximum contribution of a single, worst-case vulnerability. We define the maximum possible DamagePotential for a single vulnerability to be 300. This value is derived from a theoretical ConsequenceScore cap of 30 (representing multiple severe impacts) multiplied by the maximum ImpactScore of 10 (for a 'BLOCKER' severity). The theoretical minimum Effort is 1, representing a vulnerability requiring no privileges and no authentication. Therefore, the maximum possible contribution from a single issue is \(300/1=300\). We normalize the total score against this value as shown in Equation (7):  
\[\text{NormalizedAttackSurface}=\frac{\text{AttackSurfaceScore}}{300} \tag{7}\]  
This produces a risk score where a value of 1.0 indicates that the project's aggregate risk is equivalent to one \"worst-case\" vulnerability. This approach provides a consistent baseline for comparing different projects. To ensure the reproducibility of our scoring methodology and facilitate future research, we describe in detail how we integrated static analysis results from SonarQube with external vulnerability databases--primarily CWE and CVE repositories from MITRE and OpenCVE. It is explained in Algorithm 1. All scripts used for SonarQube data extraction, CWE/CVE mapping, and scoring are available in our public repository: [[https://github.com/yudeep-rajbhandari/attackSurfaceMetric](https://github.com/yudeep-rajbhandari/attackSurfaceMetric)]([https://github.com/yudeep-rajbhandari/attackSurfaceMetric](https://github.com/yudeep-rajbhandari/attackSurfaceMetric)), accessed on 29 June 2025. The repository includes instructions for setting up SonarQube locally to enable full pipeline reproduction. ```
0: Source code of a software project
0: A normalized attack surface score in the range \([0,1]\)
1: Perform static analysis on the input source code using SonarQube to generate issue reports. 2: For each issue found, call the SonarQube web API to retrieve its severity and HTML description. 3: Weakness Unification
4:for each issue identified do
5: Parse the HTML description (using regular expressions) to extract all CWE and OWASP identifiers. 6:if issue has OWASP identifiers then
7: Map OWASP identifiers to corresponding CWEs using MITRE's official OWASP-CWE mapping (View-1344). 8:endif
9:if issue has multiple CWE children then
10: Find the single common parent using MITRE's View-1000 hierarchy. 11:endif
12:endfor
13: Compile a final list of unique parent CWEs present in the project. 14:for each unique CWE in the list do
15: Calculate Damage Potential
16: Set ImpactScore \(\leftarrow\) value from SonarQube severity (Table 2). 17: Set ConsequenceScore \(\leftarrow\) sum of impact weights of CWE's common consequence mapped via (Table 3). 18: Set DamagePotential \(\leftarrow\) ConsequenceScore \(\times\) ImpactScore. Calculate Effort
19: Compile a list of all related CVEs from MITRE's View-1003 and the Kaggle dataset. 20: Select the top 5 most semantically related CVEs using the algorithm from [PERSON] et al. [12]
21: Initialize an empty list EffortScore.