Assume a data set which contains alert records generated by an IDS system in Table 1 where the set of items I = {1, 2, 3, 4, 5} and the set of Alerts = {Alert1, Alert2, Alert3, Alert4}. Mining all alerts that have similar frequent itemset at minimum support of 50% would require generating frequent itemsets with the alerts in the format [< itemset > Alerts-list] that allows mining more informative large itemsets as: L = { [< 1 > Alert1Alert3], [< 2 > Alert 2 Alert 3 Alert 4], < 3 > Alert 1 Alert 2 Alert 3], [< 5 > Alert 2D3 Alert 4], [< 1, 2 > Alert 2 Alert 3 Alert 4],[< 1, 3 > Alert 1 Alert 3], [< 2, 3 > Alert 2 Alert 3], [< 2, 5 > Alert 2 Alert 3 Alert 5], [< 3, 5 > Alert 2 Alert 3], [< 2, 3, 5 > Alert 2 Alert 3]}. We proposed the AlertFp algorithm for mining frequent patterns with the Alerts where they occurred. Mining Fps with Alerts on an IDS log is an important goal of this algorithm where we are linking all frequent patterns to the data set records or alert’s transactions where they came from. Then count the number of frequent patter founded on each transaction. Finally all transactions in the dataset re-sorted according to the number of the related frequent patters. AlertFp algorithm represents each frequent k-pattern as form < Fk1, Alert1k1, Alert2k1, . . . , Alertmk1>, where Fk1is the first frequent k-pattern, and Alertmk1 is the mth Alert of the first frequent k-pattern. For example, given Table1 and mini support of 50% (pattern exists on 50% of the whole alerts at least / 2 alerts at least), the list of frequent 1-itemsets is F1 ={< 1, Alert1,Alert3 >, < 2,Alert2, Alert3,Alert4 >, < 3, Alert1, Alert2, Alert3 >, < 5, Alert2, Alert3, Alert4 >}. This implies as well that the candidate 1-itemsets listed by this technique is in the same form as: C1 ={< P1, Alert11, Alert21, . . . , Alertm1 >}, where P1 is the first candidate 1-pattern, and Alertm1 is the mth Alert of the first candidate 1-pattern. For our example data set, the candidate 1-pattern is given as C1 ={< 1, Alert1,Alert3 >, < 2, Alert2, Alert3, Alert4 >, < 3, Alert1, Alert2, Alert3 >, < 4, Alert1 >, < 5, Alert2, Alert3, Alert4 >}. Thus, with this AlertFp technique, the data set is scanned only once to obtain the candidate 1-itemsets with a list of their Alerts. The Alerts of each candidate pattern is implemented. Then, the count of each candidate pattern’s Alerts is equivalent to the support of the pattern. The pattern or the itemsets having support less than the mini support are excluded from the frequent 1-itemsetAlertFP leading to the itemset <4, Alert1> being deleted from the C1 list to get F1 as we predefined the mini support as 50%. AlertFp algorithm applies the Apriori function, which works on two components of the itemsets consisting of the itemset part and the alert part and obtaining higher order frequent itemsets for their supports. After applying the frequent pattern mining algorithm to past IDS alert logs (AlertFp), in order to discover patterns that describe redundant alerts. Alert weight is measured by calculating Frequent Pattern Outlier Factor (FPOF) for each alert’s transaction.