As a result of increasing rate of information technology success, the total number of services using this technology is added every day. These services are accessible everywhere thus being exploited by unauthorized people is possible. Access control mechanism is one way to protect them. However, it is not sufficient enough because of the vulnerabilities in softwares and protocols which help the malicious people make the access control system useless. Today, scanning the users’ activities and avoiding the malicious actions is introduced as a solution for having continues service delivery. For achieving this goal, the intrusion detection systems have been created. These systems work as a sensor and iect row network traffic to report events suspected to be an attack. The produced reports are investigated by the network administrators who do the necessary actions. However, the intrusion detection systems produce flooding and false alerts which could confuse the networks administrators. Therefore, alerts should be analyzed and evaluated as a reasonable approach for decreasing and delete the unwanted and false alerts. Proposing a model for analyzing and correlating alerts and reports coming from security and network sensors is the main idea of this thesis. In this research, we investigate the requirements and problems of the different approach provided in the context of correlation, whereas the data mining approaches are specially considered. We stated that the knowledge based methods used in attack scenario produced in the workrooms, are not efficient enough for a dynamic environment with large variety of sensors such as security operation centers. The learning based methods also have the high time complexity and their analysis logic is not clear enough for users. In the proposed method, the clustering technique and association rule mining have been used to propose a model for analyzing alerts and security reports. We have decreased the false positive alerts by analyzing the reasons of an event which leads to detraction of the produced alerts andreporting the main events. The experimental results on DARPA test data set show the success of our model. Keywords: Intrusion Detection, Attack Scenario, Alert Correlation, Security Events, False Positive Alert, Data Mining
