Airs classify whether the incident is a continuation of an existing incident or is a new attack , dynamic analysis the incident , cataloging the attack and limit the response based on legal , ethical , institutional or resource constraints . adaptive intrusion response strategies are suggested based on the alarm confidence , attack frequency , assessed risk , and estimated response costs 系统通过计算报警可信度，限制入侵检测系统误报警所产生的负面影响；通过判断报警信息是新一轮攻击还是原有攻击的继续，动态分析攻击，调整攻击类别，评估威胁，并根据受保护系统的安全需求、相关政策、以及响应成功率确定响应机制。
According to some problems existed in network security information analysis , such as lacking of security description , low information visualization , false - positives and false - negatives , this paper suggests implementing correlation in integrated analysis of network alerts and logs to improve the capability of network security information analysis 摘要针对当前网络安全信息分析过程中出现的安全描述片面性、信息可视化程度低和误报警、漏报警现象等问题，提出运用关联方法对网络中的报警和日志信息进行综合分析，用于提高网络安全信息分析能力。
