A propagation analysis method regarding data traffic in a monitored sensor-based system for identifying propagation patterns, comprising the steps of: a. deploying two or more sensors within said sensor-based system, for providing data regarding access operations to said system; and b. by at least one processor: b.1 obtaining metadata concerning monitored cyber-attacks, based on analysis of the data provided by said sensors; b.2 contextually filtering portions of attacks from said metadata; b.3 creating sessions and sequences of attacks; b.4 creating a propagation graph, representing propagation of attacks across a network; b.5 analyzing said propagation graph for identifying attacker behavior by: i. detecting communities within the graph; ii. generating attacker profiles, wherein each of the attacker profiles is indicative of whether a given attacker followed a certain attack pattern being defined as propagation within or between said detected communities; iii. analyzing said attacker profiles for identifying attacker behavior; and iv. calculating an attack propagation pattern related score, characterized in that said at least one processor calculates the attack propagation pattern related score by calculating an attacker score for the given attacker based on a diversity level with respect to attack propagation patterns, wherein the attacker score is equal to, for the given attacker and in a single session, a sum of 1) a number of non-zero attack indicators of attack propagation pattern within a given community that has been detected in the graph, and 2) a product of a constant factor and a number of non-zero attack indicators of attack propagation pattern between the given community and another community that has been detected in the graph, wherein a single session is defined by all atomic attack records for the given attacker during a predetermined time interval. a. deploying two or more sensors within said sensor-based system, for providing data regarding access operations to said system; and b. by at least one processor: b.1 obtaining metadata concerning monitored cyber-attacks, based on analysis of the data provided by said sensors; b.2 contextually filtering portions of attacks from said metadata; b.3 creating sessions and sequences of attacks; b.4 creating a propagation graph, representing propagation of attacks across a network; b.5 analyzing said propagation graph for identifying attacker behavior by: i. detecting communities within the graph; ii. generating attacker profiles, wherein each of the attacker profiles is indicative of whether a given attacker followed a certain attack pattern being defined as propagation within or between said detected communities; iii. analyzing said attacker profiles for identifying attacker behavior; and iv. calculating an attack propagation pattern related score, characterized in that said at least one processor calculates the attack propagation pattern related score by calculating an attacker score for the given attacker based on a diversity level with respect to attack propagation patterns, wherein the attacker score is equal to, for the given attacker and in a single session, a sum of 1) a number of non-zero attack indicators of attack propagation pattern within a given community that has been detected in the graph, and 2) a product of a constant factor and a number of non-zero attack indicators of attack propagation pattern between the given community and another community that has been detected in the graph, wherein a single session is defined by all atomic attack records for the given attacker during a predetermined time interval. b.1 obtaining metadata concerning monitored cyber-attacks, based on analysis of the data provided by said sensors; b.2 contextually filtering portions of attacks from said metadata; b.3 creating sessions and sequences of attacks; b.4 creating a propagation graph, representing propagation of attacks across a network; b.5 analyzing said propagation graph for identifying attacker behavior by: i. detecting communities within the graph; ii. generating attacker profiles, wherein each of the attacker profiles is indicative of whether a given attacker followed a certain attack pattern being defined as propagation within or between said detected communities; iii. analyzing said attacker profiles for identifying attacker behavior; and iv. calculating an attack propagation pattern related score, i. detecting communities within the graph; ii. generating attacker profiles, wherein each of the attacker profiles is indicative of whether a given attacker followed a certain attack pattern being defined as propagation within or between said detected communities; iii. analyzing said attacker profiles for identifying attacker behavior; and iv. calculating an attack propagation pattern related score,