methods for determining cyber - attack targets include collecting and storing network event information from sensors to extract information regarding an attacker ; forming an attack scenario tree that encodes network topology and vulnerability information including paths from known compromised nodes to a set of potential targets ; calculating a likelihood for each of the paths using a processor ; calculating a probability distribution for the set of potential targets to determine which potential targets are most likely pursued by the attacker ; calculating a probability distribution over a set of nodes and node vulnerability types already accessed by the attacker ; determining a network graph edge to remove which minimizes a defender &# 39 ; s expected uncertainty over the potential targets ; and removing the determined network graph edge .