This paper presents some techniques to integrate two complementary types of alert correlation methods:those based on the similarity between alert attributes(clustering correlation),and those based on causal correlation of attacks (causal correlation).

Web text clustering algorithm based on the nonstructural data mining model;

Ontology-based similarity measure for text clustering;

Topic discovery based on text clustering techniques;