Attributing cyber attacks [journal article]