attack path discovery