A two-stage real time solution based on DBTCAN (density-based time clustering of application with noise) algorithm is presented for alert aggregation and correlation in distributed contexts.

• 提出了一种基于密度的抗噪声时间聚类算法；将警报聚合和关联分析方法运用于分布式多引擎入侵检测场合来解决上述问题.