In order to lessen the dependence on training samples significantly and eliminate rigorous constraint conditions

an alert fusion model that supports online incremental training was presented.Firstly

primary alerts vector was mapped to voting pattern

so as to reduce statistical space.Then

the conditional probability distributions of various voting patterns in normal or attack traffic were inferred via training.Afterwards

according to the variation of statistical characteristics

the composition of the traffic being detected was inferred instantly.Finally

fusion decision was made via threshold constraint method and Bayesian inference.Besides extended applicative scope

the model proposed can track and adapt to the traffic being detected well

and improve detection performance significantly only via small scale training.