1. A method for determining cyber-attack target nodes, comprising: collecting and storing network event information from a plurality of sensors to extract information regarding an attacker; forming an attack scenario tree that encodes network topology and vulnerability information including a plurality of paths from known compromised nodes to a set of potential target nodes; calculating a likelihood of an attack from the attacker for each of the plurality of paths using a processor, based on a first probability of an attack on each node in each path and a second probability of each node in each path being attacked without triggering any observations; and wherein calculating the first probability and the second probability determines which potential target nodes are most likely pursued by the attacker.