@inproceedings{b40a81448a724aaf929f8c33d746f145,
title = "Initial Review: Simplifying Attack Surface Scoring for Software Systems",
abstract = "Software attack surfaces, the entry points and channels through which a system can be compromised, are a critical aspect of security, yet they are notoriously difficult to quantify. This paper introduces a scoring mechanism that produces a normalized, objective attack-surface metric in the range of 0-1. Building on the established Damage-Potential-toEffort ratio, our model integrates findings from static analysis tools with real-world vulnerability intelligence from MITRE's CVE and CWE repositories. It computes a score by weighing each vulnerability's potential impact against the attacker effort required for exploitation. To demonstrate its core functionality, we validate the scoring system on representative projects with differing sizes and vulnerability profiles.",
keywords = "Attack Surface, Common Vulnerabilities and Exposures (CVE), Common Weakness Enumeration (CWE), MITRE, OWASP, Security, Static Code Analysis, Vulnerability",
author = "Yudeep Rajbhandari and Rokin Maharjan and Sakshi Shrestha and Tomas Cerny",
note = "Publisher Copyright: {\textcopyright} 2025 IEEE.; 19th IEEE International Conference on Service-Oriented System Engineering, SOSE 2025 ; Conference date: 21-07-2025 Through 24-07-2025",
year = "2025",
doi = "10.1109/SOSE67019.2025.00031",
language = "English (US)",
series = "Proceedings - 19th IEEE International Conference on Service-Oriented System Engineering, SOSE 2025",
publisher = "Institute of Electrical and Electronics Engineers Inc.",
pages = "234--238",
booktitle = "Proceedings - 19th IEEE International Conference on Service-Oriented System Engineering, SOSE 2025",
}