a model - based survey of alert correlation techniques .
Clustering intrusion detection alarms to support root cause analysis