Patent ID: 8261355

Claim:
A method, comprising: determining a topology of a plurality of network devices coupled between one or more servers and one or more untrusted links; determining one or more constraints for selecting network devices for deployment of an intrusion prevention feature to prevent attacks on the one or more servers; determining a plurality of equations based on the topology, wherein each of the plurality of equations represents a separate path through the plurality of network devices to one of the one or more servers; determining a function based on the one or more constraints, the function having an objective for resolving the function; resolving the function using integer programming in accordance with the objective, by operation of one or more computer processors, such that all of the plurality of equations and all of the one or more constraints are satisfied, to identify one or more of the plurality of network devices on which to deploy the intrusion prevention feature; and deploying the intrusion prevention feature to the identified one or more network devices, whereby all of the one or more servers are protected by at least one of the deployed intrusion prevention features for all the paths from the one or more untrusted links to the one or more servers through the plurality of network devices.