Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces the Unified Compliance Aggregator (UCA), a framework that consolidates outputs from multiple open-source security tools to generate a single composite score for assessing the security posture of Linux systems. By normalizing diverse outputs from tools like Lynis, OpenSCAP, AIDE, Tripwire, and Nmap NSE into a unified 0 to 100 scale, the UCA provides a clearer interpretation of system security. Experimental results demonstrate that as systems are hardened, the composite scores improve consistently, highlighting the differing behaviors of compliance and file integrity tools in security assessments.
A unified scoring system reveals that compliance and file integrity assessments can yield contrasting insights into system security.
Assessing the security posture of modern computing systems typically requires the use of multiple specialized tools. These tools focus on different aspects such as configuration compliance, file integrity, and vulnerability exposure, and their outputs are often difficult to interpret collectively. This paper introduces the Unified Compliance Aggregator (UCA), a framework that integrates several open-source security tools into a single composite score representing overall system security. The proposed framework combines outputs from Lynis, OpenSCAP (STIG and CIS profiles), AIDE, Tripwire, and Nmap NSE. A normalization process converts heterogeneous outputs into a consistent 0 to 100 scale, followed by weighted aggregation. We also introduce a logarithmic scoring model for file integrity measurements to address limitations observed in prior linear approaches. Experiments were conducted on Ubuntu 22.04 across different hardening levels and environments. Results show consistent improvement in composite scores as systems are hardened, while also revealing contrasting behavior between compliance and file integrity tools. Two case studies, a basic web server and a DVWA-based system illustrate how the framework can be applied in practical scenarios.