Abstract: Current intrusion detection systems only offer security administrators a great lot of independent, low-level alert, though there may be logical connections between them. It is a heavy burden for security administrators to analyze so many alerts, and a ser

Key words: Intrusion detection,Alert correlation,Attack intention,Attack scenario