## 3 Theoretical Background
### Alarm Reduction Algorithm Based on Hierarchical Clustering  
#### 3.1.1 Generalization Hierarchies  
We first introduce the concept of generalization hierarchy. As mentioned earlier, if newly generated alarms are arranged in a meaningful cluster according to predefined rules, operators can easily understand what is happening in the network. According to this idea, we define the concept of cluster, and classify the alarms into the cluster they belong to according to the rules. We use the basic idea of hierarchical clustering proposed by [PERSON] [44; 45]. As shown in Figure 1 below, for all the attributes in the alarm, we can use the method of hierarchical division to layer the attributes. Figure 1a shows the attribute hierarchical tree composed of IP attributes, and each leaf node of the tree represents a unique specific IP address. We can generalize it once to obtain the specific protocol using this IP, such as firewall and WWW/FTP in Figure 1a. If we continue to generalize it, we can obtain more advanced generalizations, such as DMZ and EXTERN. When we find that the generalization has reached the highest level and can no longer be generalized, we define the root of the hierarchy tree. For example, the root of the hierarchy tree to which the IP attribute belongs is ANY IP. The generalized structure of other attributes is similar, as shown in Figure 1b-d. In the past, scholars have proposed many methods for the construction of a hierarchical tree, with which we can construct a hierarchical tree for various attributes of the alarm data. \begin{table}
\begin{tabular}{c l} \hline \hline
**Symbol** & **Description** \\ \hline \(N_{i}\) & \(i\)th node of a hierarchical tree \\ \(A_{i}\) & \(i\)th alarm in an alarm set \\ \(D_{Ai-Aj}\) & The distance between \(i\)th alarm and \(j\)th alarm in an alarm set \\ \(C_{i}\) & \(i\)th alarm cluster center \\ \(\overset{\rightarrow}{X}(t)\) & In WOA, the current solution at iteration t \\ \(\overset{\rightarrow}{X^{*}}(t)\) & In WOA, the best solution at iteration t \\ \(\overset{\rightarrow}{X_{mmd}}\) & In WOA, a random solution in the current solution space \\ \(\overset{\rightarrow}{D}\) & In WOA, the distance between \(i\)th \(\overset{\rightarrow}{X}\) and \(j\)th\(\overset{\rightarrow}{X}\) \\ _SearchAgents_ & In WOA, the number of search agents to search solution simultaneously \\ _MaxIter_ & In WOA, a predetermined maximum number of iterations \\ \(C,r,a,l\) & Random numbers used in WOA to control logical judgment \\ \(E_{T}k(t,x)\) & Fitness value of alarm number for cluster center k \\ \(E_{s}(k)\) & Fitness value of alarm distance for cluster center k \\ \(O\left(C_{i},C_{j}\right)\) & The degree of overlap between \(i\)th cluster center \(C_{i}\) and \(j\)th cluster center \(C_{j}\) \\ \(ES_{\mathcal{O}}\) & Fitness value of the coincidence degree of all cluster centers in the cluster \\ _TP_ & Number of normal network traffic clustering to normal cluster \\ _TN_ & Number of network attack clustering to attack cluster \\ _FP_ & Number of network attack alarms incorrectly clustering to normal cluster \\ _FN_ & Number of normal network traffic incorrectly clustering to attack cluster \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Table of notations used in this paper. After providing the construction process of a hierarchical tree, we provide the following definitions of nodes in the hierarchical tree. **Definition 1**. : _A basic alarm is the alarm triggered by IDS that correspond to leaf nodes in the hierarchy tree. An abstract alarm is derived from the basic alarm by generalization and corresponds to intermediate or root nodes in the hierarchy number. Naturally, a basic alarm is also a special abstract alarm._  
**Definition 2**. : _In a hierarchical tree, if there is a path from \(N_{1}\) node to \(N_{2}\) node, then \(N_{1}\) is a generalization of \(N_{2}\), and \(N_{2}\) is a specification of \(N_{1}\)._  
**Definition 3**.