Alert correlation by a retrospective method. - Ping Yi; Hongkai Xing; Yue Wu 010; Linchun Li (ICOIN, 2009)