Types of correlation:
Logical correlation: Using pre-defined and customized correlation rules.
Inventory correlation: Through inventory look ups the system is able to
determine the validity of an event by simply checking the platform and
applications running on the attacked machine. If the attacked system is
not vulnerable to such type of attacks, the
event is simply discarded. For e.g. An event announcing attack against
IIS, won’t be relevant if the device is running Apache.
Cross correlation: If the event announces an event trying to exploit a
previously detected vulnerability on a device, the reliability of the
attack is raised up.
http://blog.csdn.net/cnbird2008/article/details/9223157
原文：http://www.cnblogs.com/diyunpeng/p/4050846.html