## 1 Introduction  
Today's technological world of ubiquitous connectivity as well as the related intrinsic dependence on digital infrastructure has drastically increased the attention toward cybersecurity. Cyberattacks have evolved in sophistication and scale, thereby posing significant threats to individuals, organizations, and entire counties. Furthermore, ransomware attacks, data breaches, and Distributed Denial of Service (DDoS) attacks have become commonplace with far-reaching consequences. Amidst this escalating threat landscape, anomaly detection has become a crucial tool in cybersecurity arsenals. At its core, anomaly detection empowers organizations to identify deviations from normal system behavior which often imply intrusions or malicious activities. Hence, unlike signature-based approaches that rely on known attack patterns, anomaly detection strategies should perform well when unexpected threats happen [1]. Anomalies, however, are not always attacks. When this is the case, it is nontrivial to decide what is happening. As sustainability is becoming an essential objective to reach in any kind of system, especially energy-intensive ones, automation in the detection of and reaction to attacks is key to designing secure and optimized systems. Thus, the accurate security evaluation of monitored data is pivotal to pinpoint which portions of our system are vulnerable and need to be fixed. We argue that measuring security can help us assess the actual level of system trustworthiness, which is otherwise hidden inside the architecture. In our approach, security metrics are the core of measurable security. In fact, they are designed to help assess the overall security posture, identify vulnerabilities, track security incidents, and make informed security decisions [2]. Additionally, we foster a culture of continuous improvement, thus facilitating data-driven decision making to optimize security measures and fortify the organization's defense against evolving cyber threats. Designing metrics is nontrivial and requires an in-depth knowledge of the domain we are analyzing, as we argued for Cyber-Physical Systems (CPSs) [3]. Moreover, metrics can be based on simple operations on low-level data, can be derived from models, or can be more complex when involving inferences. Software-Defined Networks (SDN) is a paradigm that perfectly suits the purpose of security metrics. SDNs centralize the management of network resources in the network control plane, thereby allowing for the dynamic and automated control of network traffic, routing, and configuration. This allows for deep traffic inspection and simple data collection in real time and thus eases the definition and collection of metrics [4]. Unfortunately, metric calculation could demand high power consumption [5], and--especially in complex networks and critical infrastructure--this would aggravate the computational load on the network controllers implementing the control plane, thus leading to inadequate and unacceptable overhead [6]. Countermeasures are achievable by offloading monitoring tasks to the nodes in the data plane, which is possible if Data Plane Programmability (DPP) is available. DPP is the enabler of the solution we propose, i.e., the data plane can be programmed to gather information about the traffic or to process it. An example of offloading computation to the data plane to detect DDoS attacks is proposed by [PERSON] et al. [7]. A metrics-oriented architecture to detect network anomalies using DPP is proposed by [PERSON] et al. [8]. In this work, the switches autonomously push alerts to the controller if an anomaly is detected. Then, the collected data are elaborated on the control plane. However, these solutions entail a sensible computational load on switches, thereby resulting in added forwarding delay that can lead to network saturation. The solution presented in this work, GRAPH4, aims at overcoming this problem by requiring in-network computation only for the nodes that really may be at risk of a given attack.