# Attack Surface Score for Software Systems
## 1 Introduction  
Security remains a critical concern throughout the software development life cycle and is likely to become even more challenging in the future. Currently, there is no simple solution to the problem of software security [1]. In this context, assessing software security becomes essential for building robust and secure systems. One important metric for evaluating security is the software attack surface, which represents the potential entry points an attacker could exploit to compromise a system [2]. Generally, systems with smaller attack surfaces are considered to be less vulnerable and, therefore, more secure than those with larger attack surfaces.  
The fact that it takes a lot of configuration even to measure a simple software makes determining the attack surface difficult. Most attack surface concepts include attack surface components such as entry points, exit points, and channels. Since these components are not general and must be worked on individually, following the nature of the program and the security objective of the institution, identifying them can be highly challenging, time-consuming, and involve a lot of human labor. Hence, in this research, we present a mechanism for calculating the attack surface of an application with minimal configuration by analyzing the source code. We have used a more all-encompassing method to calculatethe attack surface score, which is based on the flaws that the static analysis tool has identified as well as the common weakness enumerations (CWE) and common vulnerabilities and exposures (CVE) connected to those concerns. Since CWEs are general to software vulnerabilities, using them to calculate the score will give the software a general attack surface score and help to understand the status of software vulnerabilities or compare two different software in terms of exposure to attack surfaces without requiring any configuration. Even though CVEs are specific to a vulnerability and not generic, we included them in our computation to obtain a general understanding of CWE. To obtain a more comprehensive understanding of the impact caused by the CWE in terms of CVE, we averaged a list of CVEs that are connected to CWE rather than utilizing just one.  
Though we have taken a different approach to analyzing the software, i.e., using generic CWEs instead of analyzing every component specifically in terms of entry points, exit points, and channels, we have based our score on the traditional metric, Damage-Potential-to-Effort ratio, which is a quantitative attack surface measurement provided by [PERSON] et al. [3]. They clarify that not all resources contribute equally to a system's attack surface assessment because not all resources are equally likely to be accessed by an attacker. Damage potential in our context refers to the amount of harm that an attacker can cause by using a resource in an assault, while effort is the acquisition of the required access rights in order to be able to use the resource in an assault. The effort is based on the privileges needed to access each issue. The final result of the entire process is a score, which is an indicator of the attack surface of the software application.  
This paper presents a novel scoring framework and demonstrates its viability through a proof-of-concept implementation that integrates with SonarQube, a widely-used and representative static analysis tool. Our goal is to establish a methodology that is, by design, adaptable to the outputs of other analysis tools.  
The remainder of the paper is organized as follows. Section 2 presents the related works. The methodology is described in Section 3. Section 4 describes the experiments that we conducted. We compare various projects and do the analysis in Section 5. The limitations and future work are in Section 6. Finally, Section 7 concludes the paper.