1. A method for determining cyber-attack targets, comprising: collecting and storing network event information from a plurality of sensors to extract information regarding an attacker; forming an attack scenario tree that encodes network topology and vulnerability information including a plurality of paths from known compromised nodes to a set of potential targets; calculating a likelihood for each of the plurality of paths using a processor; and calculating a probability distribution for the set of potential targets to determine which potential targets are most likely pursued by the attacker.