# Attack Surface Score for Software Systems
## 2 Related Works  
Attack surface has been studied for quite some time, and one of the pioneer studies was performed by [PERSON] et al. [3] in their article \"An Attack Surface Metric\". Our model builds on their proposed Damage-Potential-to-Effort (D/E) ratio, which provides a foundational and pragmatic approach to software security measurement. A key takeaway from their work is the categorization of system resources and the importance of identifying both contributing and non-contributing components of the attack surface. Their model also introduces formal definitions for entry/exit points, communication channels, and untrusted data items, defining the attack surface as a function of the sets \(M\), \(C\), and \(I\) (entry/exit points, channels, and untrusted data). However, the model is complex, requires deep domain knowledge, and depends heavily on manually constructed I/O models, making it difficult to scale or upgrade. To address these limitations, our approach leverages static analysis and structured vulnerability data (CWE/CVE), enabling a more automated, maintainable, and up-to-date scoring system supported by the MITRE databases [4]. A complementary qualitative approach was proposed by [PERSON] et al. [5], who used grounded theory to identify the main components of attack surfaces: entry points, targets, and mechanisms through a systematic coding process applied to CVE and CWE data. They utilized data collection, memo writing, and axial coding to group vulnerabilities based on descriptive similarity. While insightful, their method relies heavily on text descriptions and often fails to match many CWEs to meaningful categories. We also use CWE/CVE data, but instead of qualitative grouping, we rely on structured CWE properties directly for scoring, thus avoiding the issue of unmatched vulnerabilities and ensuring better consistency across diverse projects. The notion of attack surface has also been explored in the context of networks. [PERSON] et al. [6] proposed a model that maps attack surface attributes like access rights and privileges to CVSS base scores, aggregating risk across an entire software system. While effective for probability estimation in network environments, their method may not translate well to source-code-level software risk. Our approach addresses this gap by applying static analysis to extract code-level vulnerabilities and by computing scores based on multiple real-world CVEs associated with each CWE, leading to a more generalizable and software-specific scoring model. More recent studies have applied machine learning to vulnerability detection. In 2024, [PERSON] et al. [7] employed machine learning to detect software vulnerabilities by training separate classifiers for each CWE, rather than using a single binary classifier across all vulnerability types. While their detection approach differs from ours, their work similarly leverages CWE and CVE data to identify vulnerabilities, highlighting a shared reliance on structured vulnerability intelligence. It is important to distinguish between vulnerability detection and attack surface quantification. While [PERSON] et al. [7] focus on accurately identifying specific CWEs in source code, our work addresses the next step: quantifying the collective risk of identified vulnerabilities. Instead of introducing a new detection method, we propose a scoring framework that processes outputs from detection tools like SonarQube, making our approach complementary to methods such as those in [7]. Static analysis continues to be central to modern security efforts. [PERSON] et al. [8] performed a systematic review of static analysis-based security methods for microservices and cloud-native applications. Their findings confirm that static tools are widely adopted in practice, consistent with our use of SonarQube for vulnerability extraction. In a separate effort, [PERSON] et al. [9] proposed a network attack surface evaluation model based on optimal attack strategies.