## 4 Proposed Method
### WOA-Based Alarm Hierarchical Clustering Process
This data can be found here: [[[https://research.unswedu.au/projects/unsw-nb15-dataset](https://research.unswedu.au/projects/unsw-nb15-dataset)]([https://research.unswedu.au/projects/unsw-nb15-dataset](https://research.unswedu.au/projects/unsw-nb15-dataset)), accessed on 18 November 2021]. Figure 19: Boxplots of the number of alarms in 8 clusters. ## Conflicts of Interest: The authors declare no conflict of interest. ## References

* [PERSON] et al. (2020) [PERSON]; [PERSON]; [PERSON] An Efficient Alert Aggregation Method Based on Conditional Rough Entropy and Knowledge Granularity. _Entropy_**2020**, _22_, 324. [CrossRef]
* [PERSON] et al. (2020) [PERSON]; [PERSON]; [PERSON] [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] A taxonomy of network threats and the effect of current datasets on intrusion detection systems. _IEEE Access_**2020**, \(8\), 104650-104675. [CrossRef]
* [PERSON] and [PERSON] (2020) [PERSON]; [PERSON] [PERSON] A survey and taxonomy of the fuzzy signature-based Intrusion Detection Systems. _Appl. Soft Comput._**2020**, _92_, 106301. [CrossRef]
* [PERSON] (2019) [PERSON]; [PERSON]; [PERSON] Deep learning approaches for anomaly-based intrusion detection systems: A survey, taxonomy, and open issues. _Knowl.-Based Syst._**2019**, _189_, 105124. [CrossRef]
* [PERSON] et al. (2019) [PERSON]; [PERSON]; [PERSON]; [PERSON] KDD Cup 99 Data Sets: A Perspective on the Role of Data Sets in Network Intrusion Detection Research. _Computer_**2019**, _52_, 41-51. [CrossRef]
* [PERSON] and [PERSON] (2015) [PERSON]; [PERSON] Performance analysis of NSL-KDD dataset using ANN. In Proceedings of the 2015 International Conference on Signal Processing and Communication Engineering Systems, Guntur, India, 2-3 January 2015; pp. 92-96. * [PERSON] et al. (2016) [PERSON]; [PERSON]; [PERSON]; [PERSON] Detecting Distributed Denial of Service Attacks Using Data Mining Techniques. _Int. J. Adv. Comput. Sci. Appl._**2016**, \(7\), 436-445. [CrossRef]
* [PERSON] and [PERSON] (2015) [PERSON]; [PERSON] [PERSON] UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, ACT, Australia, 10-12 November 2015; pp. 1-6. * [PERSON] et al. (2018) [PERSON]; [PERSON]; [PERSON] A detailed analysis of the cicids2017 data set. In Proceedings of the International Conference on Information Systems Security and Privacy, Funchal-Madeira, Portuga, 22-24 January 2018; Springer: Cham, Switzerland, 2018; pp. 172-188. * [PERSON] et al. (2020) [PERSON]; [PERSON] [PERSON]; [PERSON] [PERSON]; [PERSON] [PERSON]; [PERSON] [PERSON]; [PERSON] [PERSON]; [PERSON] LITNET-2020: An Annotated Real-World Network Flow Dataset for Network Intrusion Detection. _Electronics_**2020**, \(9\), 800. [CrossRef]
* [PERSON] et al. (2021) [PERSON]; [PERSON]; [PERSON] Clustering mixed numerical and categorical data with missing values. _Inf. Sci._**2021**, _571_, 418-442. [CrossRef]
* [PERSON] et al. (2016) [PERSON]; [PERSON]; [PERSON] Clustering data with the presence of missing values by ensemble approach. In Proceedings of the 2016 Second Asian Conference on Defence Technology (acdt), Chiang Mai, Thailand, 21-23 January 2016; pp. 151-156. * [PERSON] et al. (2019) [PERSON]; [PERSON]; [PERSON]; [PERSON] Optimal clustering with missing values. _BMC Bioinform._**2019**, _20_, 321. [CrossRef] [PubMed]
* [PERSON] et al. (2014) [PERSON]; [PERSON]; [PERSON]; [PERSON] A taxonomy on intrusion alert aggregation techniques. In Proceedings of the 2014 International Symposium on Biometrics and Security Technologies (ISBAST), Kuala Lumpur, Malaysia, 26-27 August 2014; pp. 244-249. * [PERSON] et al. (2017) [PERSON]; [PERSON] [PERSON]; [PERSON] [PERSON]; [PERSON] [PERSON] Exchanging security events: Which and how many alerts can we aggregate? In Proceedings of the 2017 IFIP/IEEE Symposium on Integrated Network and Service Management (IM), Lisbon, Portugal, 8-12 May 2017; pp. 604-607.