Abstract: How to effectively find out valuable abnormal behaviors from the numerous alarms and logs produced by all kinds of security products everyday, all of them must be analyzed and the true and non-redundant information should be extracted, which is helpful to

Key words: Alert correlation, Bayesian classifier, Search tree algorithm, Clustering