1. A computer-implemented method for intrusion attack recovery, comprising: monitoring two or more hosts in a network to generate audit logs of system events; generating one or more dependency graphs (DGraphs) based on the audit logs; determining a relevancy score for each of a plurality of edges of the DGraphs; pruning irrelevant events from the DGraphs to generate a condensed backtracking graph; and backtracking from an attack detection point in the condensed backtracking graph to locate an origin.