A subsystem that can determine basic attack activities from the cross-reference of alerts reported by heterogeneous IDSs under the guidance of primtive attack templates.

• 可在基元攻击样板的引导下,参考来自不同侦测系统的警报来判读出基本的攻击动作。