Policy
Failure to meet obligations in the extranet LAN A, according to attack schema S1, 10 times from the same source in domain Z should be reported to administrator
Formalised as
P1(O+, LAN A, S1, Domain Z, 10, "Report to administrator")
Attack Schema
S1(telnet, same, anyone, failure, from extranet,frequency)