1. A system for cyber-attack detection comprising: one or more hardware processors; and a non-transitory storage module communicatively coupled to the one or more processors, the storage module comprises logic, upon execution by the one or more processors, that accesses a first set of information that comprises (i) information directed to a plurality of observed events, each of the observed events being observed during operation of a source device communicatively coupled to the system, and (ii) information directed to one or more relationships that identify an association between different observed events, wherein each of the one or more relationships comprises a connection that occurs during computer processing between at least two events and wherein each of the plurality of observed events is an action or operation resulting from an execution of code, generates a reference model based on the first set of information, the reference model comprises at least a first observed event, a second observed event, and a first relationship that identifies that the second observed event is based on the first observed event, wherein the first observed event and the second observed event are included in the plurality of observed events, analyzes a second set of information that is different than the first set of information, the second set of information including a third event and a second relationship, enhances the reference model by adding the third event or the second relationship to the reference model based on a correlation between the reference model and the second set of information, and generates an interactive graphical display of at least the reference model that includes the third event or the second relationship, wherein a combination of events and relationships comprising the reference model indicate a cyber-attack.