Abstract: In the world facing severe threat of DDoS, finding the best countermeasure will raise the chance of survival. Defense effectiveness evaluation could help determining the best, thus it is an important part of countermeasure selecting. Current existing defense effectiveness evaluation works through comparing the attack effect before and after the deployment of defensive measures. Consequently, if the measure to be evaluated has been deployed, it needs to be removed, and then to be deployed again during the evaluation process. As a result, the cost of defense effectiveness evaluation is high. The cost can be reduced if the evaluation don't have to remove the defensive measure. In this paper, a defense effectiveness evaluation method without removing the defensive measure is proposed. Firstly, the DEM (defense effectiveness model) model is presented. It chooses indices in the perspective of normal user, which reduces the number of indices and the difficulty of measuring. Then, joined with artificial neural network, the DEM model is able to predict the attack effect before the deployment of countermeasures while the countermeasure has bean already deployed. After that, SSFNet, a network simulator, is incorporated to simulate a typical DDoS attack scenario. The result of the simulation not only validates the predictive ability of artificial neural network in DEM model, but also proves the proposed method to be correct.