Static-Dynamic Analysis of Security Metrics for Cyber-Physical Systems