Intrusion detection systems (IDS) are used to detect attacks in computer networks. Network administrators are often overwhelmed by large volumes of IDS alerts. This has motivated for automatic IDS alert analysis. The goal of automatic alert analysis is to respond IDSes challenges. Including: large volumes of alerts, large amount of false positive alerts, low-level situational awareness and alerts no correlated with others. Ideally, alert correlation should help to distinguish coordinated multi-step attacks from isolated events. Appropriate time complexity is very essential for online alert correlation. Enterprise vulnerability correlation is one of the newest methods for correlation.At first, in these methods, network vulnerabilities are analysed and attack graph is extracted then alerts are correlated based on cerated attack graph. An attacker typically breaks into a network by means a series of exploits, such that each exploit satisfies the pre-condition for subsequent exploit and makes a causal relationship among them. Such a series of exploits is called attack path and the set of all possible attack paths form an attack graph. In proposed model in this thesis exploits are extracted from an enterprise network and then are saved as insecurity signatures. Causal relationships among insecurity signatures are studied and all relations between them are extracted and results are saved in a graph. This graph is named attack type graph. All possible attack paths are extracted from attack type graph and each attack path is saved as a probable attack pattern. Then each alert produced by IDS is mapped to one node of type graph and probable attack patterns are used to correlate alerts and to discover the related probable attack scenarios. Probable attack patterns are cerated in non-real and the process must be repeated just whenever a sort of change occures in the network. Then they are used to correlate alerts as an online process. Usage of these patterns is not limited to correlate alerts. These patterns are used in different parts of network security management. One of these applications is to assess network resistance against attacks. Keywords: Intrusion Detection System, Vulnerability, Alert Correlation, Attacks Type Graph, Attack Scenario, Probable Attack Pattern.