Automatic security analysis using security metrics

Security metrics are valuable for measuring and comparing the amount of security provided by different systems and configurations. However, meaningful security metrics for networked systems are significantly difficult to define, evaluate, interpret, and visualize. We design a system that provides security metrics collection, security metrics management, and security metrics visualization for scalable and automatic security analysis. We first identify a set of new security metrics. Then, we show how to collect simple security metrics from the computers in a sample network. Next, we use Analytic Hierarchy Process (AHP) mechanism to compose two sophisticated security metrics, Criticality and Security Score, which are critical to measure the security risk. We also develop visualization tools to help administrators better understand and evaluate the system security using security metrics.