add some comments on the attack tree approach