1. A computer-implemented method for intrusion attack recovery, comprising: monitoring two or more hosts in a network to generate audit logs of system events; generating one or more dependency graphs (DGraphs) based on the audit logs; building a reference model, and determining a relevancy score for each of a plurality of edges of the DGraphs based on the reference model; pruning irrelevant events from the DGraphs to generate a condensed backtracking graph based on the relevance score, the pruning comprising: removing events from the DGraphs that are in paths exceeding a threshold length from an attack detection point, and removing resources determined to be unrelated to an attack; and backtracking from the attack detection point in the condensed backtracking graph to locate an origin.