Risk-based attack surface approximation: how much data is enough? | IEEE Conference Publication | IEEE Xplore