Risk-Based Attack Surface Approximation

In our increasingly interconnected world, software security is an increasingly important issue for development teams. However, there is too much security work to do for these teams as security needs have out-scaled security resources. To help prioritize security efforts, professionals use the attack surface of a system, or the sum of all paths for untrusted data into and out of a system, to identify security relevant code. However, identifying code that lies on the attack surface is a difficult and resource-intensive process. Our research proposes the use of crash dump stack traces as an empirical metric for approximating the attack surface. We hypothesize that code that appears on crash dump stack traces represent activity that has put the system under stress, and is therefore indicative of potential security vulnerabilities. The goal of this research is to aid software engineers in prioritizing security efforts by approximating the attack surface of a system via crash dump stack trace analysis. In a trial on Mozilla Firefox, the risk-based attack surface approximation selected 15.8% of files and contained 73.6% of known vulnerabilities. Randomly sampling 10% of crash dump stack traces for inclusion in our analysis resulted in only 2.7% fewer known vulnerabilities included on our attack surface. Through our approach, we look to optimize effort for the security community in finding, fixing and preventing security vulnerabilities.