## 4 Proposed Method
### WOA-Based Alarm Hierarchical Clustering Process
It is not difficult to see that this data set contains a large number of normal network traffic, which is identified by IDS as a malicious alarm, resulting in a large number of false alarms. Our goal is to use clustering methods to correctly identify normal network traffic and eliminate it from alarms. We analyze the source IP address and destination IP address in the experimental data set as follows. The data set contains two types of IP addresses: Class B and Class C (such as Class C IP addresses 149.171.126.43 and 149.171.126.50). We can extract the same fields and classify the IP addresses, and the uncertain part is represented by X. The statistics of each type of IP address and its number are shown in Table 4.

After analyzing the experimental data, we first explore the performance of WOAHC-L in looking for a single alarm cluster center. The specific parameters of WOAHC-L are set as follows: \(SearchAgents=10\) and \(MaxIter=50\), respectively, which means that we use 10 search agents to search the solution space of the clustering at the same time, and the maximum number of iterations of the algorithm is 50. Other parameters in WOAHC-L, such as \(r,a,p\), etc., are generated by random numbers or are related to \(MaxIter\) so we do not have to set it up. The fitness function is set as the equation mentioned in Section 4.2. According to the mechanism of WOAHC-L, the cluster center obtained by calling the algorithm for the first time has the best fitness value. In order to explore the performance of WOA in hierarchical clustering, we independently perform WOAHC-L four times and record the change in the optimal fitness value with the number of iterations during each algorithm execution. The performance of WOAHC-L is shown in Figure 14. The X axis is the number of iterations and the Y axis is the fitness value of the currently found optimal cluster center. \begin{table}
\begin{tabular}{c c c c} \hline
**Source\_IP** & **Number** & **Destination\_IP** & **Number** \\ \hline
59.166.0.X & 38,817 & 149.171.126 & 46,051 \\
175.45.176.X & 7234 & 175.45.176 & 4284 \\
149.171.126.X & 4338 & 10.40.X.X & 298 \\
10.40.X.X & 412 & 224.0.0.X & 108 \\  & & 59.166.0.X & 55 \\  & & 192.168.241 & 5 \\ \hline \end{tabular}
\end{table} 
Table 4: Distribution of source and destination IP addresses. Figure 14: Comparison of fitness values of the best search agent obtained by four calls to WOAHC-L. \begin{table}
\begin{tabular}{c c c c c} \hline  & **Attack\_Category** & **Number** & **Attack\_Category** & **Number** \\ \hline
1 & Null & 44,387 & 6 & Reconnaissance & 289 \\
2 & Generic & 4257 & 7 & Backdoor & 53 \\
3 & Exploits & 913 & 8 & Analysis & 52 \\
4 & Fizzers & 463 & 9 & Shellcode & 29 \\
5 & DoS & 355 & 10 & Worms & 3 \\ \hline \end{tabular}
\end{table} 
Table 3: Distribution of alarm labels in 50,801 pieces of data. As can be seen from Figure 14, WOAHC-L constantly seeks the most excellent cluster center in the search space through its exploitation phase and exploration phase. It can be seen from the figure that WOAHC-L has an excellent ability to break through the local optimum, which can be clearly seen from the stage of 20-50 iteration times. After verifying that WOAHC-L has excellent global search capability in alarm clustering, we continue to explore the use of WOAHC-L to solve the local clustering problem of alarm hierarchical clustering, that is, every time we call the WOAHC-L, an alarm cluster is obtained, which is obtained through the iterative search of WOAHC-L, according to the fitness function. Taking \(MaxIter\) of 50 as the maximum number of iterations and the number of search agents of 10 as an example, we perform WOAHC-L four times and obtain four cluster centers successively from 50,801 alarms. The number of alarms contained in the four cluster centers varies with the number of iterations as shown in Figure 15.

According to the experimental statistics, the number of alarms contained in each cluster obtained by calling WOAHC-L four times is as follows.