Describir: Pull-Type Security Patch Management in Intrusion Tolerant Systems: Modeling and Analysis