Attack process modeling