A system for generating and executing a distributed Internet Protocol, IP, network analysis model comprising: a text-based model definition file being a text definition file defining an IP network analysis representing analysis flow and a hierarchical analysis tree of the analysis flow; an analysis function block library comprising a plurality of analysis nodes (122a,122b) in an analysis model definition, wherein each of the analysis nodes (122a,122b) is associated with a set of attributes including execution time and a memory requirement and wherein each of the analysis nodes (122a,122b) comprises at least one reusable analysis block; wherein the analysis nodes (122a,122b) are unified analysis nodes (122a,122b) organized by means of the hierarchical analysis tree; and wherein in the unified analysis nodes (122a,122b) the number of lines of code in each analysis node (122a, 122b) is predefined, the inputs and outputs of each analysis node (122a,122b) are similar, and the analysis nodes (122a,122b) are all driven by a generic state machine; a code generator that automatically generates code to implement the distributed IP network analysis model from the analysis function block library by parsing the model definition file; and an apparatus for executing the distributed IP network analysis model comprising: a processor; and a memory coupled to the processor, wherein the memory comprises instructions that when executed on the processor, cause the processor to: execute the distributed IP network analysis model on a distributed platform, wherein the distributed platform includes a flow-based load balancer (610,820) to distribute data flow to multiple analysis nodes (122a, 122b). a text-based model definition file being a text definition file defining an IP network analysis representing analysis flow and a hierarchical analysis tree of the analysis flow; an analysis function block library comprising a plurality of analysis nodes (122a,122b) in an analysis model definition, wherein each of the analysis nodes (122a,122b) is associated with a set of attributes including execution time and a memory requirement and wherein each of the analysis nodes (122a,122b) comprises at least one reusable analysis block; wherein the analysis nodes (122a,122b) are unified analysis nodes (122a,122b) organized by means of the hierarchical analysis tree; and wherein in the unified analysis nodes (122a,122b) the number of lines of code in each analysis node (122a, 122b) is predefined, the inputs and outputs of each analysis node (122a,122b) are similar, and the analysis nodes (122a,122b) are all driven by a generic state machine; a code generator that automatically generates code to implement the distributed IP network analysis model from the analysis function block library by parsing the model definition file; and an apparatus for executing the distributed IP network analysis model comprising: a processor; and a memory coupled to the processor, wherein the memory comprises instructions that when executed on the processor, cause the processor to: execute the distributed IP network analysis model on a distributed platform, wherein the distributed platform includes a flow-based load balancer (610,820) to distribute data flow to multiple analysis nodes (122a, 122b). a processor; and a memory coupled to the processor, wherein the memory comprises instructions that when executed on the processor, cause the processor to: execute the distributed IP network analysis model on a distributed platform, wherein the distributed platform includes a flow-based load balancer (610,820) to distribute data flow to multiple analysis nodes (122a, 122b).