## 7 Conclusions and Future Works  
In conclusion, our research has demonstrated the enhanced capabilities of real-time analysis with P4 through the integration of metric-based measurements. By employing a multi-level approach, we have successfully developed an architecture that comprises (i) AG generation on the control plane, to assess the vulnerable network end hosts, and (ii) at the data plane level, providing an optimized implementation of detection metrics and computation distribution.  
Thus, this approach not only bolsters security but also contributes to the broader objective of sustainability by minimizing resource usage. In our PoC, we showcased the effectiveness of our methodology by utilizing MulVAL and entropy-based metrics such as P4 NEntropy. The results of our experiments underscore the practicality and efficiency  
Figure 10: The mean and the variance of single-switch PPTs in five test scenarios, each one of them with 50,000 packets forwarded: from 0% of packets processed with metric computation to 100%.  
of our approach in identifying and responding to security threats in real-time network environments while simultaneously promoting sustainable resource management.  
As the field of network security continues to evolve, our research contributes to the ongoing efforts to guarantee network defenses and enhance the resilience of critical infrastructures in an environmentally responsible manner. We anticipate that our approach will find applications in a wide range of network security scenarios, offering a more efficient and targeted means of safeguarding digital assets against emerging threats while contributing to sustainability objectives.  
Our study lays the foundation for future research directions in network security with security metrics. Future works could try to quantify, for some real network examples, the accurate enhancement of the total computation time for the metric thanks to the exemption of some switches from the monitoring. In addition, opportunities for innovation in this field will come from investigating alternative metrics within the architecture, other than the ones that we proposed, and delving deeper into diverse high-level and low-level metric integration. We are also aware of the need for further exploration of the dynamic adaptability of threat models, of real-world deployment scenarios, and of the interplay between security and sustainability goals. Lastly, integrating machine learning for advanced threat detection represents a promising avenue for enhancing network security and could be included in this architecture to increase accuracy in detection and adaptability to new threats. These future works aim to further advance the state of the art and contribute to more robust and resource-efficient security solutions.  
Conceptualization, G.G., L.R. and A.A.S.; Methodology, G.G., L.R. and A.A.S.; Testing G.G., L.R. and A.A.S.; Writing--original draft, G.G., L.R. and A.A.S.; Writing--review and editing, A.M., F.C. and M.P.; Supervision, A.M., F.C. and M.P. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
Data Availability Statement: Data are contained within the article.  
This work was partially supported by project SERICS (PE00000014) under the MUR National Recovery and Resilience Plan funded by the European Union--NextGenerationEU; [PERSON] was supported by the National PhD in Cybersecurity (IMT Lucca); [PERSON] was supported by the National Operating Program Research and Innovation (PON 2014-2020), action IV.5 PhD on Green subjects, by the Advanced Studies Institution (ISA) and by the International PhD College.  
The authors declare no conflict of interest.  
The following abbreviations are used in this manuscript:  
DDoS Distributed Denial of Service  
CPS Cyber-Physical Systems  
SDN Software-Defined Networks  
DPP Data Plane Programmability  
AG Attack Graph  
MAT Match Action Table  
PoC Proof of Concept  
PPT Packet Processing Time