Abstract: Disclosed is an exemplary multiple hypothesis engine that provides situation assessment capabilities regarding cyber auto tactics techniques and procedures. Dynamic cyber adversarial operations are evaluated via a combination of techniques using a Bayesian multiple hypothesis tree, or graph, as a framework. A top-down probability propagation mechanism solves different aspects of the problem in a round-robin fashion. The top-down probability propagation mechanism comprises the Hypothesis Refinement Engine. A model-based abductive reasoner comprising The Hypothesis Validator is used to confirm or refute the refined hypothesis. A model-based learning engine comprising Behavior Model Trainer is used to incrementally augment the knowledge base of behavior models as new adversarial TTPs are discovered. These three techniques behave in a cooperative manner by operating upon the Bayesian multiple hypothesis tree framework.