by filtering, polymerization, discard the false and retain the true, explore the real contact hidden between these data of the events, and provides more reliable, more valuable information for network administrators. On the the basis of research the related theory on network security event correlation analysis and related methods. proposed net event correlation analysis method based on the similar degree of attributes, and detailed description of the algorithm is given in this paper. the results of experiment verify that the correlation method can effectively reduce the number of network security incidents to solve the thorny massive alarm problem.