## 2 Background
### Security Metrics  
Security metrics are indicators capable of presenting a level of security about aspects of the systems in terms of qualitative or quantitative assessment. The metrics that are suitable for specific environments can vary a lot [3]; therefore, in order to adopt the appropriate ones, it is crucial to make a selection of them based on a clear and unified view of the complete set. To assist in the process of justified decisions, we need a taxonomy of security metrics. The literature classifies security metrics according to given categories. NIST suggests a taxonomy based on three main groups [9]: (i) management, which provides a high-level view of a security program's effectiveness and alignment with business objectives, (ii) operational, which focuses on the processes, procedures, and activities related to managing and maintaining security, and (iii) technical, which is usually measured and analyzed by IT and security teams. In this work, we will focus only on technical metrics, as we focus on network attacks. Within the technical domains, metrics can be grouped according to different criteria. A very common approach in the literature is the one cited also in [5] that classifies technical metrics into four types:  
* Vulnerability metrics, which consist of measures of system vulnerabilities that depend on the user, the interface, the hardware, or software in general. Examples are password [10], attack surface [11] and software vulnerabilities ([[https://nvd.nist.gov/vuln-metrics/cvss](https://nvd.nist.gov/vuln-metrics/cvss)]([https://nvd.nist.gov/vuln-metrics/cvss](https://nvd.nist.gov/vuln-metrics/cvss)), accessed on 1 October 2023). * Defense metrics, which measure the strength and the effort needed for placing defense mechanisms in a system. They consist of the evaluation of preventive, reactive, and proactive defenses, such as in [12]. * Situation metrics, which focus on the security state of a system and depend on the moment of analysis; these metrics dynamically evolve from time to time following the outcome of attack-defense interactions. Examples are metrics based on the frequency of security incidents or related to the investment for the security improvement [13]. Those are mainly subdivided into data-driven metrics, such as the network maliciousness metric [14], or model-driven metrics, such as the fraction of compromised computers. * Attack metrics, which measure the strength of sustained attacks. The categories previously proposed focus on the assessment of the level of security of the system via the analysis of configurations and devices; conversely, attack metrics focus on quantifying and analyzing cyberattacks and threats faced and are essential for assessing risk, measuring the success of security measures, and guiding the allocation of resources. Examples are the network bandwidth that a botnet can use to launch DOS attacks or the occurrence of obfuscation in malware samples [15]. More ways to classify metrics exist, which are based on their scope (e.g., network, device, system, architecture, etc.) or the result types (e.g., quantitative or qualitative). Metrics evaluation can also be automated or manually configured: they can change dynamically at runtime or whenever a system reconfiguration occurs. Moreover, metrics can be simple measurements or be modeled as a complex system. Without an assessment of its correctness, any kind of metric can lead to information that does not provide accurate and meaningful insights. Assessing the correctness and soundness of security metrics is crucial because it enables informed decision making, effective risk management, and sensible resource allocation. Accurate metrics help in evaluating the effectiveness of security measures, benchmarking against industry standards, and identifying improvement areas. They enhance transparency, build trust, and ensure the organization adapts to emerging threats appropriately. Thus, avoiding incorrect metrics is essential to prevent misinterpretations and misguided security actions.