Risk = Probability * Size of Loss
the user can calculate the weight of each attack path by multiplying its
relevant attributes ratings together. This quantitative ranking enables security
managers to prioritize the allocation of measures based on his/her ranking