An empirical model of the security intrusion process