With the daily growing use of computer networks especially Internet, the growing skill of the users and intruders and also with the prese nce of vulnerable points in softwares; securing systems of computer networks become more important than before. An important tool for detecting attacks in computer networks is Intrusion Detection System (IDS). Today, the most important challenge for using these tools is the high volume of alerts created by the system which practically makes the alert investigation impossible. To overcome this challenge, a huge volume of research has been made in the preprocessing and alert correlation steps of the IDS. Totally, alert correlation methods are divided in to two categories: knowledge based alert correlation and inference based alert correlation. Inference based methods use statistical analysis and artificial intelligent techniques for alert correlating. This thesis tries to present an efficient and effective approach for alert correlation based on data mining techniques and statistical analysis. In this research, it is tried to identify the main necessities of a correlation system and then implement them using efficient algorithms. The presented approach tries to detect the pattern behind the occurrence of alerts and provide them for system manager in the form of correlation rules. as characteristics of this method can be mention is Simultaneously use of knowledge base and alert occurrence information, non-use time window And thus no restrictions on the detection of slow attacks, No need for training, detection Different complex types of attack such as one to many and many to one patterns and Ability of detect Regular pattern that produce by malware and other Suspicious software. we use DARPA2000 dataset to evaluation this algorithm and compare our method with two similar reference methods. Experimental results show that the proposed method has the ability to compete the best research done in this field, even the knowledge based techniques. Keywords: Alert correlation, data minig, Intrusion detection , alert pattern discovery
