The associated methods based on causal relationship. this method is by comparing the results of the first occurrence of the alarm information behavior and the prerequisite of the next occurrence alarm information behavior. it is able to associate two alarm information accurately and flexibly. it not only can revel the causal relationship between the known attack scene alarm information, but also can adapt to change in the supply of attack mode, to find unknown attack scenarios. at the same time Super alarms associated graph can also be intuitive reproduce the attack scene.