## 4 Proposed Method
### Encoding and Decoding  
We first introduced the encoding and decoding scheme of the local version of the WOA applied to hierarchical clustering. In this scheme, a search agent in the WOA corresponds to a cluster center of hierarchical clustering. As mentioned above, a cluster center is composed of a basic alarm or an abstract alarm, so we can obtain the data structure encoded by the search agent. Each attribute in the alarm corresponds to a binary string in the encoded data structure, represented by 0 or 1, as shown in Figure 4.  
Figure 5a shows the coding scheme of the cluster center in binary form, and Figure 5b shows the attribute values of the cluster center corresponding to this coding. Figure 4 shows an alarm with four attributes (A, B, C, and D) with decimal values of 3, 6, 1, and 5.  
Figure 4: A cluster center (A3,B6,C1,D5) and its corresponding coding scheme: (**a**) the coding scheme of the cluster center; (**b**) the cluster center (A3,B6,C1,D5).  
The four attribute fields of the alarm are located in their respective hierarchical trees, as shown in Figure 5.  
We can find the location of the node corresponding to the binary-encoded attribute in the hierarchical tree. At the same time, we can easily obtain the binary fragment corresponding to the alarm through the hierarchical tree. This coding scheme indicates that a search agent corresponds to a cluster center. The goal of the WOA is to find the best search agent for the fitness function over multiple iterations, output its corresponding cluster center, and categorize the alarms that belong to that cluster.  
In this encoding and decoding scheme, a WOA search agent corresponds to a cluster center, assuming that the cluster center is composed of \(N\) attributes and the binary length of each attribute is \(K\), then the encoding length of a search agent is \(N*K\), corresponding to \(N\) hierarchical trees.  
After giving the encoding and decoding scheme of the local version WOA-hierarchical tree, we introduce the encoding and decoding schemes of the global version WOA-hierarchical tree. In the coding scheme of the global version, a WOA search agent is composed of a group of cluster centers. Assuming that WOA eventually obtains \(C\) cluster centers, each of which is composed of \(N\) attributes with length \(K\), the coding length of the global version WOA-hierarchical tree is \(C*N*K\). Let us take the example shown in Figure 6 for illustration.  
In Figure 6, there are three hierarchical trees corresponding to the three attributes of an alarm, respectively. If we need to finally obtain three cluster centers for this alarm set, which are \((\text{A4},\text{B2},\text{C3})\), \((\text{A1},\text{B1},\text{C2})\) and \((\text{A3},\text{B2},\text{C4})\), then one of our search agents can be encoded as shown in Figure 7a in the second coding method. Figure 7b shows the three cluster centers corresponding to this coding scheme.  
Figure 5: Hierarchical tree structure for attributes A, B, C and D. (**a**) three-layer tree structure of attribute A; (**b**) four-layer tree structure of attribute B; (**c**) three-layer tree structure of attribute C; (**d**) four-layer tree structure of attribute D.  
Figure 6: Hierarchical tree structure for attributes A, B and C.