Defining a simple metric for real-time security level evaluation of multi-sites networks

In previous research work, we have developed a centralized security operation center (SOC) [2] and a distributed SOC [4]. These environments are very useful to react to intrusions or to analyze security problem because they provide a global view of the network without adding any kinds of software on network components. They therefore lack the possibility to have a real-time metric which measures the security health of the different sites. The idea is to have, in one look, an indication of the security level of all the sites of the network. In this article, we propose to define such a metric which gives the user 3 states for a given network.