{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T16:41:07Z","timestamp":1780332067645,"version":"3.54.1"},"reference-count":37,"publisher":"MDPI AG","issue":"11","license":[{"start":{"date-parts":[[2023,11,15]],"date-time":"2023-11-15T00:00:00Z","timestamp":1700006400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>The correct and efficient measurement of security properties is key to the deployment of effective cyberspace protection strategies. In this work, we propose GRAPH4, which is a system that combines different security metrics to design an attack detection approach that leverages the advantages of modern network architectures. GRAPH4 makes use of attack graphs that are generated by the control plane to extract a view of the network components requiring monitoring, which is based on the specific attack that must be detected and on the knowledge of the complete network layout. It enables an efficient distribution of security metrics tasks between the control plane and the data plane. The attack graph is translated into network rules that are subsequently installed in programmable nodes in order to enable alerting and detecting network anomalies at a line rate. By leveraging data plane programmability and security metric scores, GRAPH4 enables timely responses to unforeseen conditions while optimizing resource allocation and enhancing proactive defense. This paper details the architecture of GRAPH4, and it provides an evaluation of the performance gains it can achieve.<\/jats:p>","DOI":"10.3390\/fi15110368","type":"journal-article","created":{"date-parts":[[2023,11,15]],"date-time":"2023-11-15T10:57:46Z","timestamp":1700045866000},"page":"368","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":8,"title":["GRAPH4: A Security Monitoring Architecture Based on Data Plane Anomaly Detection Metrics Calculated over Attack Graphs"],"prefix":"10.3390","volume":"15","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-3218-6703","authenticated-orcid":false,"given":"Giacomo","family":"Gori","sequence":"first","affiliation":[{"name":"Department of Computer Science and Engineering (DISI), Alma Mater Studiorum\u2014 Universit\u00e0 di Bologna, 40136 Bologna, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1767-7256","authenticated-orcid":false,"given":"Lorenzo","family":"Rinieri","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering (DISI), Alma Mater Studiorum\u2014 Universit\u00e0 di Bologna, 40136 Bologna, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5560-9871","authenticated-orcid":false,"given":"Amir","family":"Al Sadi","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering (DISI), Alma Mater Studiorum\u2014 Universit\u00e0 di Bologna, 40136 Bologna, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0101-2551","authenticated-orcid":false,"given":"Andrea","family":"Melis","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering (DISI), Alma Mater Studiorum\u2014 Universit\u00e0 di Bologna, 40136 Bologna, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6669-8072","authenticated-orcid":false,"given":"Franco","family":"Callegati","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering (DISI), Alma Mater Studiorum\u2014 Universit\u00e0 di Bologna, 40136 Bologna, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3962-5513","authenticated-orcid":false,"given":"Marco","family":"Prandini","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering (DISI), Alma Mater Studiorum\u2014 Universit\u00e0 di Bologna, 40136 Bologna, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2023,11,15]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"19","DOI":"10.1016\/j.jnca.2015.11.016","article-title":"A survey of network anomaly detection techniques","volume":"60","author":"Ahmed","year":"2016","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Gori, G., Melis, A., Berardi, D., Prandini, M., Al Sadi, A., and Callegati, F. (2023, January 8\u201311). Towards the Creation of Interdisciplinary Consumer-Oriented Security Metrics. Proceedings of the 2023 IEEE 20th Consumer Communications & Networking Conference (CCNC), Las Vegas, NV, USA.","DOI":"10.1109\/CCNC51644.2023.10060733"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Gori, G., Melis, A., Rinieri, L., Prandini, M., Al Sadi, A., and Callegati, F. (2022, January 19\u201322). Metrics for Cyber-Physical Security: A call to action. Proceedings of the 2022 International Symposium on Networks, Computers and Communications (ISNCC), Shenzhen, China.","DOI":"10.1109\/ISNCC55209.2022.9851735"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"402","DOI":"10.1109\/TNSM.2020.3048277","article-title":"P-scor: Integration of constraint programming orchestration and programmable data plane","volume":"18","author":"Melis","year":"2020","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_5","first-page":"1","article-title":"A survey on systems security metrics","volume":"49","author":"Pendleton","year":"2016","journal-title":"ACM Comput. Surv. CSUR"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Obadia, M., Bouet, M., Rougier, J.L., and Iannone, L. (2015, January 13\u201317). A greedy approach for minimizing SDN control overhead. Proceedings of the 2015 1st IEEE Conference on Network Softwarization (NetSoft), London, UK.","DOI":"10.1109\/NETSOFT.2015.7116135"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"4019","DOI":"10.1109\/TDSC.2021.3116345","article-title":"Tracking Normalized Network Traffic Entropy to Detect DDoS Attacks in P4","volume":"19","author":"Ding","year":"2021","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Gao, S., Handley, M., and Vissicchio, S. (2021, January 10\u201312). Stats 101 in p4: Towards in-switch anomaly detection. Proceedings of the Twentieth ACM Workshop on Hot Topics in Networks, Virtual Event.","DOI":"10.1145\/3484266.3487370"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Swanson, M.M., Bartol, N., Sabato, J., Hash, J., and Graffo, L. (2003). Security Metrics Guide for Information Technology Systems, Special Publication (NIST SP).","DOI":"10.6028\/NIST.SP.800-55"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"78","DOI":"10.3390\/jcp1010005","article-title":"Password similarity using probabilistic data structures","volume":"1","author":"Berardi","year":"2020","journal-title":"J. Cybersecur. Priv."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"371","DOI":"10.1109\/TSE.2010.60","article-title":"An attack surface metric","volume":"37","author":"Manadhata","year":"2010","journal-title":"IEEE Trans. Softw. Eng."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"33","DOI":"10.1016\/j.cose.2018.08.003","article-title":"Dynamic security metrics for measuring the effectiveness of moving target defense techniques","volume":"79","author":"Hong","year":"2018","journal-title":"Comput. Secur."},{"key":"ref_13","unstructured":"Zhan, Z., Xu, M., and Xu, S. (2015). Proceedings of the Trusted Systems: 6th International Conference, INTRUST 2014, Beijing, China, 16\u201317 December 2014, Springer. Revised Selected Papers 6."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Zhang, J., Durumeric, Z., Bailey, M., Liu, M., and Karir, M. (2014, January 23\u201326). On the Mismanagement and Maliciousness of Networks. Proceedings of the NDSS, San Diego, CA, USA.","DOI":"10.14722\/ndss.2014.23057"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/2522968.2522972","article-title":"Binary-code obfuscations in prevalent packer tools","volume":"46","author":"Roundy","year":"2013","journal-title":"ACM Comput. Surv. CSUR"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"106","DOI":"10.14445\/22312803\/IJCTT-V41P119","article-title":"Security metrics and the risks: An overview","volume":"41","author":"Ahmed","year":"2016","journal-title":"Int. J. Comput. Trends Technol. IJCTT"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"87","DOI":"10.1145\/2656877.2656890","article-title":"P4: Programming Protocol-Independent Packet Processors","volume":"44","author":"Bosshart","year":"2014","journal-title":"ACM SIGCOMM Comput. Commun. Rev."},{"key":"ref_18","unstructured":"Consortium, T.P.L. (2023, October 01). P4Runtime Specification. Available online: https:\/\/opennetworking.org\/wp-content\/uploads\/2020\/10\/P4Runtime-Specification-120.html."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"69","DOI":"10.1145\/1355734.1355746","article-title":"OpenFlow: Enabling innovation in campus networks","volume":"38","author":"McKeown","year":"2008","journal-title":"ACM SIGCOMM Comput. Commun. Rev."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"108880","DOI":"10.1016\/j.comnet.2022.108880","article-title":"An experimental study on latency-aware and self-adaptive service chaining orchestration in distributed NFV and SDN infrastructures","volume":"208","author":"Gharbaoui","year":"2022","journal-title":"Comput. Netw."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Sadi, A.A., Savi, M., Berardi, D., Melis, A., Prandini, M., and Callegati, F. (2023, January 6\u20139). Real-time Pipeline Reconfiguration of P4 Programmable Switches to Efficiently Detect and Mitigate DDoS Attacks. Proceedings of the 2023 26th Conference on Innovation in Clouds, Internet and Networks and Workshops (ICIN), Paris, France.","DOI":"10.1109\/ICIN56760.2023.10073501"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"379","DOI":"10.1002\/j.1538-7305.1948.tb01338.x","article-title":"A mathematical theory of communication","volume":"27","author":"Shannon","year":"1948","journal-title":"Bell Syst. Tech. J."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"145","DOI":"10.1145\/1140103.1140295","article-title":"Data streaming algorithms for estimating entropy of network traffic","volume":"34","author":"Lall","year":"2006","journal-title":"ACM SIGMETRICS Perform. Eval. Rev."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Wang, L., Singhal, A., and Jajodia, S. (2007, January 29). Toward measuring network security using attack graphs. Proceedings of the 2007 ACM Workshop on Quality of Protection, Alexandria, VA, USA.","DOI":"10.1145\/1314257.1314273"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Lippmann, R., Ingols, K., Scott, C., Piwowarski, K., Kratkiewicz, K., Artz, M., and Cunningham, R. (2006, January 23\u201325). Validating and restoring defense in depth using attack graphs. Proceedings of the MILCOM 2006\u20142006 IEEE Military Communications Conference, Washington, DC, USA.","DOI":"10.1109\/MILCOM.2006.302434"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Mehta, V., Bartzis, C., Zhu, H., Clarke, E., and Wing, J. (2006, January 20\u201322). Ranking attack graphs. Proceedings of the International Workshop on Recent Advances in Intrusion Detection, Hamburg, Germany.","DOI":"10.1007\/11856214_7"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Pamula, J., Jajodia, S., Ammann, P., and Swarup, V. (2006, January 30). A weakest-adversary security metric for network configuration security analysis. Proceedings of the 2nd ACM Workshop on Quality of Protection, Alexandria, VA, USA.","DOI":"10.1145\/1179494.1179502"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"52","DOI":"10.1109\/MSP.2008.9","article-title":"Estimating a system\u2019s mean time-to-compromise","volume":"6","author":"Leversage","year":"2008","journal-title":"IEEE Secur. Priv."},{"key":"ref_29","unstructured":"Homer, J., Ou, X., and Schmidt, D. (2009). A Sound and Practical Approach to Quantifying Security Risk in Enterprise Networks, Kansas State University. Kansas State University Technical Report."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"61","DOI":"10.1109\/TDSC.2011.34","article-title":"Dynamic security risk management using bayesian attack graphs","volume":"9","author":"Poolsappasit","year":"2011","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"30","DOI":"10.1109\/TDSC.2013.24","article-title":"k-zero day safety: A network security metric for measuring the risk of unknown vulnerabilities","volume":"11","author":"Wang","year":"2013","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"1071","DOI":"10.1109\/TIFS.2016.2516916","article-title":"Network diversity: A security metric for evaluating the resilience of networks against zero-day attacks","volume":"11","author":"Zhang","year":"2016","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"2704","DOI":"10.1109\/COMST.2017.2745505","article-title":"Model-based quantitative network security metrics: A survey","volume":"19","author":"Ramos","year":"2017","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_34","unstructured":"Ou, X., Govindavajhala, S., and Appel, A.W. (August, January 31). MulVAL: A logic-based network security analyzer. Proceedings of the USENIX Security Symposium, Baltimore, MD, USA."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"1936","DOI":"10.1109\/TDSC.2020.3041999","article-title":"Extending attack graphs to represent cyber-attacks in communication protocols and modern it networks","volume":"19","author":"Stan","year":"2020","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_36","unstructured":"Boyer, W., and McQueen, M. (2008). Proceedings of the Critical Information Infrastructures Security: Second International Workshop, CRITIS 2007, M\u00e1laga, Spain, 3\u20135 October 2007, Springer. Revised Papers 2."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"146","DOI":"10.1109\/69.43410","article-title":"What you always wanted to know about Datalog (and never dared to ask)","volume":"1","author":"Ceri","year":"1989","journal-title":"IEEE Trans. Knowl. Data Eng."}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/15\/11\/368\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T21:23:14Z","timestamp":1760131394000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/15\/11\/368"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,11,15]]},"references-count":37,"journal-issue":{"issue":"11","published-online":{"date-parts":[[2023,11]]}},"alternative-id":["fi15110368"],"URL":"https:\/\/doi.org\/10.3390\/fi15110368","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,11,15]]}}}