  Alert correlation is a system which receives alerts from heterogeneous
Intrusion Detection Systems and reduces false alerts, detects high level
patterns of attacks, increases the meaning of occurred incidents, predicts the
future states of attacks, and detects root cause of attacks. To reach these
goals, many algorithms have been introduced in the world with many advantages
and disadvantages. In this paper, we are trying to present a comprehensive
survey on already proposed alert correlation algorithms. The approach of this
survey is mainly focused on algorithms in correlation engines which can work in
enterprise and practical networks. Having this aim in mind, many features
related to accuracy, functionality, and computation power are introduced and
all algorithm categories are assessed with these features. The result of this
survey shows that each category of algorithms has its own strengths and an
ideal correlation frameworks should be carried the strength feature of each
category.
