The diamond model of intrusion analysis