Abstract: Traditional intrusion detection systems（IDSs） only provide large amount of independent, low-level attack alerts, though there may be logical connections between them. As a result, it is difficult for users or response systems to understand the alerts and

Key words: Intrusion detection,Attack scenario,Correlation,Alarm reduction,Online analysis