“Intrusion Detection Systems” have been developed and extended in order to examine suspected activities by monitoring and reviewing the raw traffic of the network and reporting the necessary alarm by issuing a message if an attack is diagnosed.Furthermore, alerts of firewall, honeypot and other security sensors are available also that face us with a huge volume of security alerts in addition to the alerts produced by the “Intrusion Detection Systems”. Therefore, understanding the security conditions of the protected network is very difficult for the network manager or the responsive system against the breach. Next to the useful alerts among the huge amount of the reports, there are a large number of useless reports that cause the recognition of the security situation of the system to become almost impossible by the network manager. Therefore, analyzing and correlation of the alert is used. The goal of this work is offering a solution for a real time extraction of the required information from the incoming data flow for the network manager and elucidating a model for correlation and analyzing of the extracted data. Complex event processing provides capability of high speed extracting information in real-time stream processing. Our proposed model grants accessing useful and analyzable information to the expert. Results show that the model is so faster than the other event correlation models. Also they show that the proposed model is more efficient in event correlation’s parameters such as false negative and number of clusters. Keywords: Intrusion Detection, Event Analysis, Alert Correlation, Complex Event Processing, Clustering
