https://www.kim-herzig.de/2017/01/17/risk-based-attack-surface-approximation-much-data-enough-icse-2017/