Friends, Not Foes: Enhancing Attack Surface Metrics of Web Applications with Large Language Models

The attack surface refers to all potential points of entry in a system that an attacker could exploit. In this work, we present an advanced metric for calculating the attack surface of web applications by leveraging the capabilities of large language models (LLMs) and introducing new features based on recent evaluations of the OWASP Top 10 security risks. Incorporating 28 parameters across 9 main categories and drawing on past studies to address previously identified limitations, this metric provides a comprehensive assessment of the attack surface. The Euclidean norm of the metric allows for quantitative comparisons, enabling precise evaluation and monitoring of security risks. Additionally, we develop a tool to facilitate the calculation of attack surface parameters, with the source code available as open source. The tool features an interface that visualizes the attack surface vector, presenting the metrics of web applications in graphical form. Among its many uses, web security analysts can employ our metric and tool to monitor changes in an application's attack surface across different versions. We also provide recommendations for further improving attack surface metric calculations using LLMs.