An alert correlation algorithm based on the sequence pattern mining

Sequence correlation method has limits in unknown attacks identification and requires pre-defining the causal relationship between attack behavior. To solve this problem, an alert correlation algorithm, denoted as TPrefixSpan, based on the sequence pattern mining is proposed in this paper, based on PrefixSpan algorithm, TPrefixSpan algorithm introduces time interval that can thoroughly narrow, the search space, then time cost on repeated dataset scan in the sequence pattern mining is greatly saved, the efficiency of the PrefixSpan algorithm is ensured. Compared with PrefixSpan algorithm, TPrefixSpan algorithm generates much precise attacks identification. In order to visualize the correlation rules better, a sequence diagram generation algorithm of attack behavior is put forward.