"An Attack Surface Metric." IEEE Transactions on Software Engineering 37, no. 3 (2011): 371-386.