"An Attack Surface Metric." IEEE Transactions on Software Engineering 37, no. 3 (2011): 371-386.

"A Formal Model for A System?s Attack Surface." In Moving Target Defense: Creating Asymmetric Uncertainty for Cyber Threats, 1-29., 2011.