1. Fusing A Heterogeneous Alert Stream Into Scenarios
O. Dain and R.K. Cummingham
From: Applications of data Mining in Computer Security (Eds. D. Barabara and S. Jajodia)

2. Objective
To combine alerts (generated by multiple IDSs in an organization) into scenarios
Each scenario is a sequence of actions performed by a single actor or an organization
To group alerts that share a common cause
False alarm probabilities are assigned to scenarios rather than individual alerts
For each new alarm generated, compare it to existing scenarios and compute probability that it belongs to that

3. Data Mining Techniques
Used to assign probabilities for an alert to belong to a scenario---to provide better predictive power
Since attackers often use the same tools or attack types, many features were included to indicate if any previous alerts in the scenario are the exact same type as the current alert and if the most recent alert in the scenario is the same as the new alert
Attackers focus on a single host---so destination address is one of the features