The Experts below are selected from a list of 36972 Experts worldwide ranked by ideXlab platform
Pratyusa K Manadhata - One of the best experts on this subject based on the ideXlab platform.
-
game theoretic approaches to Attack Surface shifting
Moving Target Defense, 2013Co-Authors: Pratyusa K ManadhataAbstract:A software system’s Attack Surface is the set of ways in which the system can be Attacked. In our prior work, we introduced an Attack Surface measurement and reduction method to mitigate a software system’s security risk (Manadhata, An Attack Surface metric, Ph.D. thesis, Carnegie Mellon University, 2008; Manadhata and Wing, IEEE Trans. Softw. Eng. 37:371–386, 2011). In this paper, we explore the use of Attack Surface shifting in the moving target defense approach. We formalize the notion of shifting the Attack Surface and introduce a method to quantify the shift. We cast the moving target defense approach as a security-usability trade-off and introduce a two-player stochastic game model to determine an optimal moving target defense strategy. A system’s defender can use our game theoretic approach to optimally shift and reduce the system’s Attack Surface.
-
Moving Target Defense - Game Theoretic Approaches to Attack Surface Shifting
Moving Target Defense II, 2012Co-Authors: Pratyusa K ManadhataAbstract:A software system’s Attack Surface is the set of ways in which the system can be Attacked. In our prior work, we introduced an Attack Surface measurement and reduction method to mitigate a software system’s security risk (Manadhata, An Attack Surface metric, Ph.D. thesis, Carnegie Mellon University, 2008; Manadhata and Wing, IEEE Trans. Softw. Eng. 37:371–386, 2011). In this paper, we explore the use of Attack Surface shifting in the moving target defense approach. We formalize the notion of shifting the Attack Surface and introduce a method to quantify the shift. We cast the moving target defense approach as a security-usability trade-off and introduce a two-player stochastic game model to determine an optimal moving target defense strategy. A system’s defender can use our game theoretic approach to optimally shift and reduce the system’s Attack Surface.
-
Moving Target Defense - A Formal Model for a System’s Attack Surface
Advances in Information Security, 2011Co-Authors: Pratyusa K Manadhata, Jeannette M. WingAbstract:Practical software security metrics and measurements are essential for secure software development. In this chapter, we introduce the measure of a software system’s Attack Surface as an indicator of the system’s security. The larger the Attack Surface, the more insecure the system. We formalize the notion of a system’s Attack Surface using an I/O automata model of the system and introduce an Attack Surface metric to measure the Attack Surface in a systematic manner. Our metric is agnostic to a software system’s implementation language and is applicable to systems of all sizes. Software developers can use the metric in multiple phases of the software development process to improve software security. Similarly, software consumers can use the metric in their decision making process to compare alternative software.
-
A Formal Model for A System's Attack Surface
Development, 2011Co-Authors: Pratyusa K Manadhata, Jeannette M. WingAbstract:Practical software security metrics and measurements are essential for secure software development. In this chapter, we introduce the measure of a software system's Attack Surface as an indicator of the system's security. The larger the Attack Surface, the more insecure the system. We formalize the notion of a system's Attack Surface using an I/O automata model of the system and introduce an Attack Surface metric to measure the Attack Surface in a systematic manner. Our metric is agnostic to a software system's implementation language and is applicable to systems of all sizes. Software developers can use the metric in multiple phases of the software development process to improve software security. Similarly, software consumers can use the metric in their decision making process to compare alternative software.
-
An Attack Surface Metric
IEEE Transactions on Software Engineering, 2011Co-Authors: Pratyusa K Manadhata, Jeannette M. WingAbstract:Measurement of software security is a long-standing challenge to the research community. At the same time, practical security metrics and measurements are essential for secure software development. Hence, the need for metrics is more pressing now due to a growing demand for secure software. In this paper, we propose using a software system's Attack Surface measurement as an indicator of the system's security. We formalize the notion of a system's Attack Surface and introduce an Attack Surface metric to measure the Attack Surface in a systematic manner. Our measurement method is agnostic to a software system's implementation language and is applicable to systems of all sizes; we demonstrate our method by measuring the Attack Surfaces of small desktop applications and large enterprise systems implemented in C and Java. We conducted three exploratory empirical studies to validate our method. Software developers can mitigate their software's security risk by measuring and reducing their software's Attack Surfaces. Our Attack Surface reduction approach complements the software industry's traditional code quality improvement approach for security risk mitigation and is useful in multiple phases of the software development lifecycle. Our collaboration with SAP demonstrates the use of our metric in the software development process.
Indrajit Ray - One of the best experts on this subject based on the ideXlab platform.
-
Using Attack Surface entry points and reachability analysis to assess the risk of software vulnerability exploitability
Proceedings - 2014 IEEE 15th International Symposium on High-Assurance Systems Engineering HASE 2014, 2014Co-Authors: Awad A Younis, Y K Malaiya, Indrajit RayAbstract:An unpatched vulnerability can lead to security breaches. When a new vulnerability is discovered, it needs to be assessed so that it can be prioritized. A major challenge in software security is the assessment of the potential risk due to vulnerability exploitability. CVSS metrics have become a de facto standard that is commonly used to assess the severity of a vulnerability. The CVSS Base Score measures severity based on exploitability and impact measures. CVSS exploitability is measured based on three metrics: Access Vector, Authentication, and Access Complexity. However, CVSS exploitability measures assign subjective numbers based on the views of experts. Two of its factors, Access Vector and Authentication, are the same for almost all vulnerabilities. CVSS does not specify how the third factor, Access Complexity, is measured, and hence we do not know if it considers software properties as a factor. In this paper, we propose an approach that assesses the risk of vulnerability exploitability based on two software properties - Attack Surface entry points and reach ability analysis. A vulnerability is reachable if it is located in one of the entry points or is located in a function that is called either directly or indirectly by the entry points. The likelihood of an entry point being used in an Attack can be assessed by using damage potential-effort ratio in the Attack Surface metric and the presence of system calls deemed dangerous. To illustrate the proposed method, five reported vulnerabilities of Apache HTTP server 1.3.0 have been examined at the source code level. The results show that the proposed approach, which uses more detailed information, can yield a risk assessment that can be different from the CVSS Base Score.
-
HASE - Using Attack Surface Entry Points and Reachability Analysis to Assess the Risk of Software Vulnerability Exploitability
2014 IEEE 15th International Symposium on High-Assurance Systems Engineering, 2014Co-Authors: Awad A Younis, Y K Malaiya, Indrajit RayAbstract:An unpatched vulnerability can lead to security breaches. When a new vulnerability is discovered, it needs to be assessed so that it can be prioritized. A major challenge in software security is the assessment of the potential risk due to vulnerability exploitability. CVSS metrics have become a de facto standard that is commonly used to assess the severity of a vulnerability. The CVSS Base Score measures severity based on exploitability and impact measures. CVSS exploitability is measured based on three metrics: Access Vector, Authentication, and Access Complexity. However, CVSS exploitability measures assign subjective numbers based on the views of experts. Two of its factors, Access Vector and Authentication, are the same for almost all vulnerabilities. CVSS does not specify how the third factor, Access Complexity, is measured, and hence we do not know if it considers software properties as a factor. In this paper, we propose an approach that assesses the risk of vulnerability exploitability based on two software properties - Attack Surface entry points and reach ability analysis. A vulnerability is reachable if it is located in one of the entry points or is located in a function that is called either directly or indirectly by the entry points. The likelihood of an entry point being used in an Attack can be assessed by using damage potential-effort ratio in the Attack Surface metric and the presence of system calls deemed dangerous. To illustrate the proposed method, five reported vulnerabilities of Apache HTTP server 1.3.0 have been examined at the source code level. The results show that the proposed approach, which uses more detailed information, can yield a risk assessment that can be different from the CVSS Base Score.
Jeannette M. Wing - One of the best experts on this subject based on the ideXlab platform.
-
Moving Target Defense - A Formal Model for a System’s Attack Surface
Advances in Information Security, 2011Co-Authors: Pratyusa K Manadhata, Jeannette M. WingAbstract:Practical software security metrics and measurements are essential for secure software development. In this chapter, we introduce the measure of a software system’s Attack Surface as an indicator of the system’s security. The larger the Attack Surface, the more insecure the system. We formalize the notion of a system’s Attack Surface using an I/O automata model of the system and introduce an Attack Surface metric to measure the Attack Surface in a systematic manner. Our metric is agnostic to a software system’s implementation language and is applicable to systems of all sizes. Software developers can use the metric in multiple phases of the software development process to improve software security. Similarly, software consumers can use the metric in their decision making process to compare alternative software.
-
A Formal Model for A System's Attack Surface
Development, 2011Co-Authors: Pratyusa K Manadhata, Jeannette M. WingAbstract:Practical software security metrics and measurements are essential for secure software development. In this chapter, we introduce the measure of a software system's Attack Surface as an indicator of the system's security. The larger the Attack Surface, the more insecure the system. We formalize the notion of a system's Attack Surface using an I/O automata model of the system and introduce an Attack Surface metric to measure the Attack Surface in a systematic manner. Our metric is agnostic to a software system's implementation language and is applicable to systems of all sizes. Software developers can use the metric in multiple phases of the software development process to improve software security. Similarly, software consumers can use the metric in their decision making process to compare alternative software.
-
An Attack Surface Metric
IEEE Transactions on Software Engineering, 2011Co-Authors: Pratyusa K Manadhata, Jeannette M. WingAbstract:Measurement of software security is a long-standing challenge to the research community. At the same time, practical security metrics and measurements are essential for secure software development. Hence, the need for metrics is more pressing now due to a growing demand for secure software. In this paper, we propose using a software system's Attack Surface measurement as an indicator of the system's security. We formalize the notion of a system's Attack Surface and introduce an Attack Surface metric to measure the Attack Surface in a systematic manner. Our measurement method is agnostic to a software system's implementation language and is applicable to systems of all sizes; we demonstrate our method by measuring the Attack Surfaces of small desktop applications and large enterprise systems implemented in C and Java. We conducted three exploratory empirical studies to validate our method. Software developers can mitigate their software's security risk by measuring and reducing their software's Attack Surfaces. Our Attack Surface reduction approach complements the software industry's traditional code quality improvement approach for security risk mitigation and is useful in multiple phases of the software development lifecycle. Our collaboration with SAP demonstrates the use of our metric in the software development process.
-
An Approach to Measuring a System's Attack Surface
2007Co-Authors: Pratyusa K Manadhata, Kymie M. C. Tan, R.a. Maxion, Jeannette M. WingAbstract:Abstract : Practical software security measurements and metrics are critical to the improvement of software security. We propose a metric to determine whether one software system is more secure than another similar system with respect to their Attack Surface. We use a system's Attack Surface measurement as an indicator of the system's security; the larger the Attack Surface, the more insecure the system. We measure a system's Attack Surface in terms of three kinds of resources used in Attacks on the system: methods, channels, and data. We demonstrate the use of our Attack Surface metric by measuring the Attack Surfaces of two open source IMAP servers and two FTP daemons. We validated the Attack Surface metric by conducting an expert user survey and by performing statistical analysis of Microsoft Security Bulletins. Our metric can be used as a tool by software developers in the software development process and by software consumers in their decision making process.
-
QoP - Measuring the Attack Surfaces of two FTP daemons
Proceedings of the 2nd ACM workshop on Quality of protection - QoP '06, 2006Co-Authors: Pratyusa K Manadhata, Jeannette M. Wing, Mark A. Flynn, Miles McqueenAbstract:Software consumers often need to choose between different software that provide the same functionality. Today, security is a quality that many consumers, especially system administrators, care about and will use in choosing one soft- ware system over another. An Attack Surface metric is a security metric for comparing the relative security of similar software systems [7]. The measure of a system's Attack Surface is an indicator of the system's security: given two systems, we compare their Attack Surface measurements to decide whether one is more secure than another along each of the following three dimensions: methods, channels, and data. In this paper, we use the Attack Surface metric to measure the Attack Surfaces of two open source FTP daemons: ProFTPD 1.2.10 and Wu-FTPD 2.6.2. Our measurements show that ProFTPD is more secure along the method dimension, ProFTPD is as secure as Wu-FTPD along the channel dimension, and Wu-FTPD is more secure along the data dimension. We also demonstrate how software consumers can use the Attack Surface metric in making a choice between the two FTP daemons.
Rüdiger Kapitza - One of the best experts on this subject based on the ideXlab platform.
-
quantifiable run time kernel Attack Surface reduction
International Conference on Detection of intrusions and malware and vulnerability assessment, 2014Co-Authors: Anil Kurmus, Sergej Dechand, Rüdiger KapitzaAbstract:The sheer size of commodity operating system kernels makes them a prime target for local Attackers aiming to escalate privileges. At the same time, as much as 90% of kernel functions are not required for processing system calls originating from a typical network daemon. This results in an unnecessarily high exposure. In this paper, we introduce kRazor, an approach to reduce the kernel’s Attack Surface by limiting the amount of kernel code accessible to an application. kRazor first traces individual kernel functions used by an application. kRazor can then detect and prevent uses of unnecessary kernel functions by a process. This step is implemented as a kernel module that instruments select kernel functions. A heuristic on the kernel function selection allows kRazor to have negligible performance overhead. We evaluate results under real-world workloads for four typical server applications. Results show that the performance overhead and false positives remain low, while the Attack Surface reduction can be as high as 80%.
-
DIMVA - Quantifiable Run-Time Kernel Attack Surface Reduction
Detection of Intrusions and Malware and Vulnerability Assessment, 2014Co-Authors: Anil Kurmus, Sergej Dechand, Rüdiger KapitzaAbstract:The sheer size of commodity operating system kernels makes them a prime target for local Attackers aiming to escalate privileges. At the same time, as much as 90% of kernel functions are not required for processing system calls originating from a typical network daemon. This results in an unnecessarily high exposure. In this paper, we introduce kRazor, an approach to reduce the kernel’s Attack Surface by limiting the amount of kernel code accessible to an application. kRazor first traces individual kernel functions used by an application. kRazor can then detect and prevent uses of unnecessary kernel functions by a process. This step is implemented as a kernel module that instruments select kernel functions. A heuristic on the kernel function selection allows kRazor to have negligible performance overhead. We evaluate results under real-world workloads for four typical server applications. Results show that the performance overhead and false positives remain low, while the Attack Surface reduction can be as high as 80%.
-
NDSS - Attack Surface Metrics and Automated Compile-Time OS Kernel Tailoring.
2013Co-Authors: Anil Kurmus, Reinhard Tartler, Daniela Dorneanu, Bernhard Heinloth, Valentin Rothberg, Andreas Ruprecht, Wolfgang Schröder-preikschat, Daniel Lohmann, Rüdiger KapitzaAbstract:The economy of mechanism security principle states that program design should be kept as small and simple as possible. In practice, this principle is often disregarded to maximize user satisfaction, resulting in systems supporting a vast number of features by default, which in turn offers Attackers a large code base to exploit. The Linux kernel exemplifies this problem: distributors include a large number of features, such as support for exotic filesystems and socket types, and Attackers often take advantage of those. A simple approach to produce a smaller kernel is to manually configure a tailored Linux kernel. However, the more than 11,000 configuration options available in recent Linux versions make this a time-consuming and non-trivial task. We design and implement an automated approach to produce a kernel configuration that is adapted to a particular workload and hardware, and present an Attack Surface evaluation framework for evaluating security improvements for the different kernels obtained. Our results show that, for real-world server use cases, the Attack Surface reduction obtained by tailoring the kernel ranges from about 50% to 85%. Therefore, kernel tailoring is an attractive approach to improve the security of the Linux
-
Attack Surface metrics and automated compile time os kernel tailoring
Network and Distributed System Security Symposium, 2013Co-Authors: Anil Kurmus, Reinhard Tartler, Daniela Dorneanu, Bernhard Heinloth, Valentin Rothberg, Andreas Ruprecht, Daniel Lohmann, Wolfgang Schroderpreikschat, Rüdiger KapitzaAbstract:The economy of mechanism security principle states that program design should be kept as small and simple as possible. In practice, this principle is often disregarded to maximize user satisfaction, resulting in systems supporting a vast number of features by default, which in turn offers Attackers a large code base to exploit. The Linux kernel exemplifies this problem: distributors include a large number of features, such as support for exotic filesystems and socket types, and Attackers often take advantage of those. A simple approach to produce a smaller kernel is to manually configure a tailored Linux kernel. However, the more than 11,000 configuration options available in recent Linux versions make this a time-consuming and non-trivial task. We design and implement an automated approach to produce a kernel configuration that is adapted to a particular workload and hardware, and present an Attack Surface evaluation framework for evaluating security improvements for the different kernels obtained. Our results show that, for real-world server use cases, the Attack Surface reduction obtained by tailoring the kernel ranges from about 50% to 85%. Therefore, kernel tailoring is an attractive approach to improve the security of the Linux
-
Attack Surface reduction for commodity os kernels trimmed garden plants may attract less bugs
European Workshop on System Security, 2011Co-Authors: Anil Kurmus, Alessandro Sorniotti, Rüdiger KapitzaAbstract:Kernel vulnerabilities are a major current practical security problem, as attested by the weaknesses and flaws found in many commodity operating system kernels in recent years. Ever-growing code size in those projects, due to the addition of new features and the reluctance to remove legacy support, indicate that this problem will remain a severe system security threat in the foreseeable future. Reactive measures such as bug fixes via code reviews and testing, while effective, can only alleviate the issue. Furthermore, common practices in system hardening often focus on complex and sometimes hard to achieve goals that require extensive manual intervention such as security policies for sandboxing. In this paper, we explore an alternative, automated and effective way of reducing the Attack Surface in commodity operating system kernels, which we call trimming. Trimming is a two-fold process: an initial analysis of a given system for unused kernel code sections is followed by an enforcement phase, in which the unused sections are removed or prevented from being executed. We discuss the requirements that should be reflected in the design of a trimming infrastructure, and present a lightweight and flexible implementation example for the Linux kernel by using dynamic binary instrumentation as provided by kprobes. Our evaluations show we can, in the case of a web server, reduce the Attack Surface of the kernel (in terms of the number of kernel functions accessible from unprivileged users) by about 88%.
Yueqiang Cheng - One of the best experts on this subject based on the ideXlab platform.
-
KASR: A Reliable and Practical Approach to Attack Surface Reduction of Commodity OS Kernels.
arXiv: Cryptography and Security, 2018Co-Authors: Zhi Zhang, Yueqiang Cheng, Surya Nepal, Qingni Shen, Fethi A. RabhiAbstract:Commodity OS kernels have broad Attack Surfaces due to the large code base and the numerous features such as device drivers. For a real-world use case (e.g., an Apache Server), many kernel services are unused and only a small amount of kernel code is used. Within the used code, a certain part is invoked only at runtime while the rest are executed at startup and/or shutdown phases in the kernel's lifetime run. In this paper, we propose a reliable and practical system, named KASR, which transparently reduces Attack Surfaces of commodity OS kernels at runtime without requiring their source code. The KASR system, residing in a trusted hypervisor, achieves the Attack Surface reduction through a two-step approach: (1) reliably depriving unused code of executable permissions, and (2) transparently segmenting used code and selectively activating them. We implement a prototype of KASR on Xen-4.8.2 hypervisor and evaluate its security effectiveness on Linux kernel-4.4.0-87-generic. Our evaluation shows that KASR reduces the kernel Attack Surface by 64% and trims off 40% of CVE vulnerabilities. Besides, KASR successfully detects and blocks all 6 real-world kernel rootkits. We measure its performance overhead with three benchmark tools (i.e., SPECINT, httperf and bonnie++). The experimental results indicate that KASR imposes less than 1% performance overhead (compared to an unmodified Xen hypervisor) on all the benchmarks.
-
RAID - KASR: A Reliable and Practical Approach to Attack Surface Reduction of Commodity OS Kernels
Research in Attacks Intrusions and Defenses, 2018Co-Authors: Zhi Zhang, Yueqiang Cheng, Surya Nepal, Qingni Shen, Fethi A. RabhiAbstract:Commodity OS kernels have broad Attack Surfaces due to the large code base and the numerous features such as device drivers. For a real-world use case (e.g., an Apache Server), many kernel services are unused and only a small amount of kernel code is used. Within the used code, a certain part is invoked only at runtime while the rest are executed at startup and/or shutdown phases in the kernel’s lifetime run. In this paper, we propose a reliable and practical system, named KASR, which transparently reduces Attack Surfaces of commodity OS kernels at runtime without requiring their source code. The KASR system, residing in a trusted hypervisor, achieves the Attack Surface reduction through a two-step approach: (1) reliably depriving unused code of executable permissions, and (2) transparently segmenting used code and selectively activating them. We implement a prototype of KASR on Xen-4.8.2 hypervisor and evaluate its security effectiveness on Linux kernel-4.4.0-87-generic. Our evaluation shows that KASR reduces the kernel Attack Surface by 64% and trims off 40% of CVE vulnerabilities. Besides, KASR successfully detects and blocks all 6 real-world kernel rootkits. We measure its performance overhead with three benchmark tools (i.e., SPECINT, httperf and bonnie++). The experimental results indicate that KASR imposes less than 1% performance overhead (compared to an unmodified Xen hypervisor) on all the benchmarks.
-
A Reliable and Practical Approach to Kernel Attack Surface Reduction of Commodity OS.
arXiv: Cryptography and Security, 2018Co-Authors: Zhi Zhang, Yueqiang Cheng, Surya Nepal, Qingni Shen, Fethi A. RabhiAbstract:Commodity OS kernels are known to have broad Attack Surfaces due to the large code base and the numerous features such as device drivers. For a real-world use case (e.g., an Apache Server), many kernel services are unused and only a small amount of kernel code is used. Within the used code, a certain part is invoked only at the runtime phase while the rest are executed at startup and/or shutdown phases in the kernel's lifetime run. In this paper, we propose a reliable and practical system, named KASR, which transparently reduces Attack Surfaces of commodity OS kernels at the runtime phase without requiring their source code. The KASR system, residing in a trusted hypervisor, achieves the Attack Surface reduction through two reliable steps: (1) deprives unused code of executable permissions, and (2) transparently segments used code and selectively activates them according to their phases. KASR also prevents unknown code from executing in the kernel space, and thus it is able to defend against all kernel code injection Attacks. We implement a prototype of KASR on the Xen-4.8.2 hypervisor and evaluate its security effectiveness on Linux kernel-4.4.0-87-generic. Our evaluation shows that KASR reduces kernel Attack Surface by 64%, trims off 40% of in-memory CVE vulnerabilities and 66% of system calls, and prohibits 99% of on-disk device drivers (including their related CVEs) from executing. Besides, KASR successfully detects and blocks all 6 real-world kernel rootkits. We measure its performance overhead with three benchmark tools (i.e., SPECINT, httperf and bonnie++). The experimental results indicate that KASR imposes less than 1% averaged performance overhead compared to an unmodified Xen hypervisor.
-
spoke scalable knowledge collection and Attack Surface analysis of access control policy for security enhanced android
Computer and Communications Security, 2017Co-Authors: Ruowen Wang, Ahmed M Azab, William Enck, Peng Ning, Xun Chen, Wenbo Shen, Yueqiang ChengAbstract:SEAndroid is a mandatory access control (MAC) framework that can confine faulty applications on Android. Nevertheless, the effectiveness of SEAndroid enforcement depends on the employed policy. The growing complexity of Android makes it difficult for policy engineers to have complete domain knowledge on every system functionality. As a result, policy engineers sometimes craft over-permissive and ineffective policy rules, which unfortunately increased the Attack Surface of the Android system and have allowed multiple real-world privilege escalation Attacks. We propose SPOKE, an SEAndroid Policy Knowledge Engine, that systematically extracts domain knowledge from rich-semantic functional tests and further uses the knowledge for characterizing the Attack Surface of SEAndroid policy rules. Our Attack Surface analysis is achieved by two steps: 1) It reveals policy rules that cannot be justified by the collected domain knowledge. 2) It identifies potentially over-permissive access patterns allowed by those unjustified rules as the Attack Surface. We evaluate SPOKE using 665 functional tests targeting 28 different categories of functionalities developed by Samsung Android Team. SPOKE successfully collected 12,491 access patterns for the 28 categories as domain knowledge, and used the knowledge to reveal 320 unjustified policy rules and 210 over-permissive access patterns defined by those rules, including one related to the notorious libstagefright vulnerability. These findings have been confirmed by policy engineers.
-
AsiaCCS - SPOKE: Scalable Knowledge Collection and Attack Surface Analysis of Access Control Policy for Security Enhanced Android
Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, 2017Co-Authors: Ruowen Wang, Ahmed M Azab, William Enck, Peng Ning, Xun Chen, Wenbo Shen, Yueqiang ChengAbstract:SEAndroid is a mandatory access control (MAC) framework that can confine faulty applications on Android. Nevertheless, the effectiveness of SEAndroid enforcement depends on the employed policy. The growing complexity of Android makes it difficult for policy engineers to have complete domain knowledge on every system functionality. As a result, policy engineers sometimes craft over-permissive and ineffective policy rules, which unfortunately increased the Attack Surface of the Android system and have allowed multiple real-world privilege escalation Attacks. We propose SPOKE, an SEAndroid Policy Knowledge Engine, that systematically extracts domain knowledge from rich-semantic functional tests and further uses the knowledge for characterizing the Attack Surface of SEAndroid policy rules. Our Attack Surface analysis is achieved by two steps: 1) It reveals policy rules that cannot be justified by the collected domain knowledge. 2) It identifies potentially over-permissive access patterns allowed by those unjustified rules as the Attack Surface. We evaluate SPOKE using 665 functional tests targeting 28 different categories of functionalities developed by Samsung Android Team. SPOKE successfully collected 12,491 access patterns for the 28 categories as domain knowledge, and used the knowledge to reveal 320 unjustified policy rules and 210 over-permissive access patterns defined by those rules, including one related to the notorious libstagefright vulnerability. These findings have been confirmed by policy engineers.