first pass at attacker aggregation