## 4 Proposed Method
### WOA-Based Alarm Hierarchical Clustering Process
According to the fitness function, each search agent calculates a fitness value. The search agent with the best fitness value is the optimal search agent, and the cluster center represented by the agent is the final cluster center set. Based on the WOA exploitation phase and exploration phase, the cluster center set represented by the search agent with the optimal fitness value is finally obtained after several iterations. WOAHC-G differs from WOAHC-L in that WOAHC-G only needs to execute once to obtain all cluster centers, while WOAHC-L needs to execute several times until the number of remaining alarms is insufficient for the next algorithm execution. In addition, WOAHC-G considers the problem of coincidence degree between different cluster centers and takes the coincidence degree as an important indicator of fitness value. Therefore, the fitness function of the algorithm needs to be changed to add the coincidence degree of cluster centers, as shown in Equation (12). \[\mathbf{O}\big{(}\mathbf{C}_{i},\mathbf{C}_{j}\big{)}=\left\{ \begin{array}{ll}\mathbf{1}, \mathbf{C}_{i}\cap&\mathbf{C}_{j}=\varnothing\\ \mathbf{0},\mathbf{C}_{i}\cap&\mathbf{C}_{j}\
eq\varnothing\end{array} \right. \tag{12}\]

where \(\mathbf{C}_{i},\mathbf{C}_{j}\) represent two cluster centers. If each attribute of the two cluster centers has no intersection, the coincidence degree is considered to be 0; otherwise, it is 1. After the calculation function of clustering coincidence degree is given, the evaluation equation of clustering coincidence degree is given as Equation (13). \[ES_{o}=\frac{2}{k(k-1)}\sum_{0\leq i<j\leq k}O\big{(}C_{i},C_{j}\big{)} \tag{13}\]

where \(k\) represents the number of cluster centers. When there are \(k\) cluster centers, \(\frac{k(k-1)}{2}\) times are needed to calculate the coincidence degree between them. Therefore, the coefficient in the calculation formula of \(ES_{o}\) is set as \(\frac{2}{k(k-1)}\) to ensure that the value of \(ES_{o}\) is within the interval [0, 1]. The alarm clustering process based on WOAHC-G is shown in Figure 13.

Figure 12: Alarm reduction framework flow chart based on WOAHC-L. The algorithm pseudocode of WOAHC-G is shown in Algorithm 3
```
0: N, maxIteration, mutation rate, t = 0, k = 0
0: alarm_center[], alarms after clustering
1: Randomly generate initial population Xi (i = 1, 2,..., N)
2: Calculate the fitness value of each solution
3: Get the best Xi that has the largest fitness value, mark it as X*
4:while t < MaxIterationdo
5:for population Xi (i = 1, 2,..., N) do
6: Use Equations (3)-(5) to update a,A,C
7: Generate values for random numbers 1 and p
8:if p < 0.5 then
9:if \(|A|<\) 1 then
10: Use Equations (1) and (2) to update the position of Xi
11: Apply mutation operation on X* (best solution) given mutation rate (r) to get Xmut
12: Perform crossover operation between Xmut and Xi
13: Set the new position of Xi to the output of crossover operation
14:elseif \(|A|\geq\) 1 then
15: Select a random search agent (Xrand)
16: Use Equations (8) and (9) to update the position of Xi
17: Apply mutation operation on Xrand given mutation rate (r) to get Xmut
18: Perform crossover operation between Xmut and Xrand
19: Set the new position of Xi to the output of crossover operation
20:endif
21:elseif p \(\geq\) 0.5 then
22: Use Equation (6) to update the position of the current solution Xi
23: Apply mutation operation on X* (best solution) given mutation rate (r) to get Xmut
24: Perform crossover operation between Xmut and Xi
25: Set the new position of Xi to the output of crossover operation
26:endif
27:endfor
28: Calculate the fitness of each solution, check if any solution goes beyond the search space
29: If there is a better solution Xi, update Xi as X*
30: t = t + 1
31:endwhile
32:return X*
```

**Algorithm 3** WOA for alarm hierarchical clustering (global version)

## 5 Experiments and Results

### Experiment Data Set

In this section we describe the data sets used in the experiment. We use UNSW-NB15 as the experimental data set [8].