Patent ID: 8239951

Claim:
A method for evaluating a security characteristic, the method comprising: (a) generating a network model representative of a topology of a network and of vulnerabilities of network nodes; (b) generating an attack dictionary representative of attack actions on at least one network node of the network model; (c) determining access and Intrusion Detection and Prevention (IDP) information representative of communication paths through the network model and of IDP rules applied during the communication paths; (d) evaluating at least one first result of at least one attack on at least one network node, based on the network model; (g) evaluating a security characteristic in response to the at least one first result; wherein the security characteristic is at least one out of (i) a location of at least one IDP entity, and (ii) a security level of the network; receiving legitimate traffic information indicative of required communication between a client and a service; evaluating an effect of at least one IDP rule applied by the IDP entity on the legitimate traffic, based upon the network model, wherein the evaluating comprises determining if the IDP entity is expected to block legitimate traffic; determining an effectiveness of the IDP entity in response to the evaluated effects; and graphically illustrating the evaluated effects; and wherein the determining of the effectiveness is responsive to information representing a penalty that is incurred if the legitimate traffic is stopped.