Abstract: To reduce effectively the frequency of alerts and extract useful information from them, an algorithm was proposed to mine and analyze the patterns of intrusion alert streams on the basis of CLOSET algorithm. In a distributed intrusion detection system, the algorithm can help the response component mine and analyze the alerts especially their frequently closed patterns from its detection components so as to response in reference to the patterns. To find latent intrusion, the intrusion detection message exchange format (IDMEF) was extended with a concept of suspicion level proposed. To study further those alerts which are highly suspicious but less frequent, the algorithm as above was improved by adding a parameter of lowest suspicion level to it. Experimental results showed that both algorithms are effective in reducing the frequency of alerts but the improved one is better at mining useful information.