We use CBR for learning new attacks; what are the attributes and values that we need to construct a base case?
I think that the similarity exist in the attacker model (socio-psychological ...) also the behavior before the attacks.
When it comes to argumentation, check ACSCL research of Omid Noroozi, who graduated from Wageningen University.
The attributs you need are those that characterize your domain (i.e, attacks). This characterization step (domian modeling) is very important, because if the case description is not well characterized, then the CBR system will not be very accurate.
You must think in what features are really important to describe an attack, and especially which features makes that two somewhat similar atacks are really differents !! Those will be the most relevant features to discriminate among similar attcks.
A usual way of modeling the domain is to consult some experts in that domain, if they are available, or consult related literature. Anyway, your own rational thinking and understanding of the problem must guide you to select the relevant , discriminant and nececssary features for your problem at hand (i.e attacks in your case).
Regarding the range of possible values for each feature, you must set them according to the nature and usual scale of values (numerical features) or usual set of qualitative values (qualitative/categorical features). Again, if the experts are available they can help to set the usual range of values for the features, or if you hava data avilable, you can extract them from data.
-- Miquel.
I have written some preliminary papers regarding CBR and security attacks. It might be of interest to you : )