Size & Complexity Design Metrics Identification to Predict Software’s Future Attack Surface at Design Stage for Object Oriented Design

Software security failures are common and a long standing challenge to the research community. We can conceptualize the vulnerability of an application through its attack surface size. A system's attack surface is an indicator of the system’s security. Unfortunately predicting software’s future attack surface size during design phase in earlier stage of software development life cycle (SDLC) is largely missing. Our objective is to investigate the statistical relationship between system’s attack surface with various size and complexity metrics to find a set of size and complexity metrics which is/are best suitable to predict software’s future attack surface early in software development cycle. In this research paper, we investigate whether software design metrics can be utilized as early indicators of system’s future attack surface size. For an experimental setting, nine open-source java-based projects were