Nowadays, it becomes more and more important to construct high-level attack scenarios from low-level intrusion alerts reported by intrusion detection systems (IDSs). Some methods have been presented to resolve this problem. These methods have different strengths. However, they also have different limitations. In order to build complicated attack processes accurately, this paper uses cluster and correlation techniques to construct high-level attack scenarios. Fuzzy cluster algorithm based on the similarity of attack attributes is proposed to classify alerts generated by IDSs. And then in every ...
