Abstract: With the gradual development of network application fields, the attack patterns have reached their delicacy and multi-steps from the coarse and simplistic pattern in their early days. In order to redeem the flaws of intrusion detection technology, an intrusion alert correlation model based on data mining and ontology (IACMDO) is proposed. IACMDO deals with underlayer alert through cluster and classification, and builds attack knowledge model by ontology, realizing the detection, tracing and predicting against multi-steps attack. The performance of traditional IDS is upgraded through simulations of KDD Cup 1999 and DAPRA 2000 datasets, which verifies the efficiency of the proposed alert correlation model.

Key words: computer engineering, intrusion detection, intrusion alert correlation, data mining, ontology