Alert correlation survey: framework and techniques
STATL: An Attack Language for State-based Intrusion Detection