Realtime attack detection, choke point containment analysis, and counterfactual simulation