Computer networks are essential in today's information society. These networks are usually connected to the global internet network. Since security had not been considered as one of the original internet design goals, in recent decades securing networks against attacks has become very much important. Nowadays various security systems and tools such as Intrusion Detection Systems (IDS) are deployed in networks to provide security. When an IDS observes any suspicious events representing an unauthorized access, abuse or harmful activity damaging systems and computer networks, it produces some alerts. But extracting useful information from these alerts is not as easy: (1) IDSs may flag a large number of alerts every day, thus flooding alerts and overwhelming the security officers. (2) Among the alerts produced by IDSs false alerts are mixed with true ones. (3) IDSs cannot detect all the attempts of attacks and may miss some alerts. (4) There are some causal relationships between continuous steps of an attack scenario, but IDSs do not detect correlations among the alerts. Therefore analyzing the alerts is necessary for extracting useful information from thousands of alerts produced by one or more IDSs. We can suppose each alert as a symptom of a low-level attack. Alert correlation is a process of analyzing alerts produced by one or more intrusion detection systems. This process aims to provide a high-level view of occurring or attempted intrusions. Alert correlation systems attempt to discover the relations among IDS alerts to determine the attack scenarios and their main motivations. The main purpose of this thesis is to propose a new IDS alert correlation method to detect attack scenarios in real-time. After reviewing the literature on alert correlation, the main issues and challenges are analyzed and a new method is proposed. The proposed method is based on causal approach due to the strength of causal methods in practice. Most of causal methods can be deployed offline but not in real-time due to time and memory limitations. In the proposed method the knowledge base of attack patterns is represented in a graph model called Causal Relations Graph. This graph contains low-level attack patterns in the form of their prerequisites and consequences. In addition, it is a clear representation of causal relations among the low-level attacks. In causal methods, after receiving each alert, a search is performed on the knowledge base of attack patterns to find correlated alerts. But our proposed algorithm consists of two disjoint parts. Before receiving any alerts, for each attack pattern we do a search to discover all its correlations with other attacks. The result of each search Key Words Attack, Intrusion, Attack Scenario, Intrusion Detection System, Alert, Alert Correlation, Graph