Intelligence Intrusion Detection Prevention Systems (IDPs) have played an important role to defend our networks from malware attacks. However, since they are still unable to detect an unknown attack, i.e. the zero-day attack, the ultimate challenge in the intrusion detection field is how we can exactly identify such an attack. This paper presents a novel approach which differs from the traditional detection models that are based on intelligence. The proposed method can extract unknown activities from IDS alerts by applying data mining technique.