Traditional multi-step attack correlation approaches based on intrusion alerts face the challenge of recognizing attack scenarios because these approaches require complex pre-de fined association rules as well as a high dependency on expert knowledge.Meanwhile,they bare ly consider the privacy issues.Under such circumstance,a novel algortthm is proposed to con- struct multistep attack scenarios based on discovering attack behavior sequential patterns.It an- atyzes time sequential characteristics of attack behaviors and implements a support evaluation method.An optimized candidate attack sequence generation method is applied to solve the prob- lem of predefined association rules complexity as well as expert knowledge dependency.An en- hanced k-anonymity method is applied on this algorithm to realize privacypreserving feature.Fxperimental results indicate that the algorithm has comparatively better performance and accuracy on multistep attack correlation and reaches a well balance between efficiency and privacy issues.