In-event real-time alarm method and system based on association detection

The invention provides an in-event real-time alarm method and system based on association detection, and the method comprises the steps: selecting a sample from an alarm information base according to a predefined rule, and the selected sample is a set of all alarm information data items of a same attack source for a same attack target in a one-wave attack; mining and screening association rules of the samples, and obtaining a plurality of types of alarm information sets with specific relationships in combination with the occurrence time of the alarm information; and for each type of alarm information set with a specific relationship, scene reconstruction is carried out by taking improvement of the alarm efficiency as a target, and alarm is carried out based on the alarm information set after scene reconstruction, so that the alarm efficiency is improved. According to the method, the alarm information sets with different relations are obtained through association rule mining, scene reconstruction is further ca