You can only find the source of an Internet attack if there's a data flow to follow.
This decomposed process is a DFD, data flow diagram.