1. A method for testing an intrusion detection system usable to detect attacks against a network location, comprising: presenting each of a plurality of attack instances corresponding to a given attack to the intrusion detection system being tested, the plurality of attack instances generated by modifying a given attack instance using a plurality of transformation rules of a formal transformation system, the transformation rules substantially preserving the semantics of the given attack instance; determining, for each presented attack instance, whether the intrusion detection system being tested generated an alert in response to being presented with that attack instance; evaluating the intrusion detection system being tested based on results of determining, for each presented attack instance, whether the intrusion detection system being tested generated an alert in response to being presented with that attack instance.