## 4 Proposed Method
### WOA-Based Alarm Hierarchical Clustering Process
The UNSW-NB15 data set was developed by Ixia Perfectstorm. It is used to simulate and generate real and contemporary attack models. This

Figure 13: Alarm reduction framework flow chart based on WOAHC-G.

is a tool called Tcpdump, which contains up to 100 GB of PCAP files and is used to simulate nine different types of attacks. These include DOS, Shellcode, worms, Fuzzers, backdoors, exploits, analytics, generality, and scouts. In addition, the data set consists of 12 algorithms for generating 49 features belonging to class tags. The following Table 2 shows a set of features in UNSW-NB15, along with the corresponding groups and data types. The UNSW-NB15 data set has a total of 2,540,044 records, which are stored in four files respectively. In order to better conduct the experiment, the data set provides the training set and test set that have removed the missing values, with 175,341 records and 82,332 records respectively. As can be seen from the above table, the 49 fields in the data set include fields of different types, such as Flow, Basic, Content, Time, Content, etc., and each attribute belongs to either the discrete or continuous types. ### Experimental Setup

The experimental operating environment used Intel Core i5-7500 CPU 3.40 GHz and 8 GB memory. The configuration of the software environment is as follows: the operating system is Microsoft Windows 10, the experimental program is written in Python, and the development version is Python 3.7.3. We use PyCharm and Jupyter Notebook as the integrated development environment for Python. In addition, we use WEKA as an auxiliary tool for data processing and analysis. WEKA is an open-source machine learning and data mining software based on Java environment [49]. It is one of the most complete data mining tools today. ### Experimental Results

As mentioned above, we use the UNSW-NB15 data set as our experimental data set. A total of 50,801 data were randomly selected from the training set and test set to carry out the clustering calculation of the alarm. The extracted alarm label distribution is shown in Table 3. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Category** & **No** & **Name** & **Data Type** & **Category** & **No** & **Name** & **Data Type** \\ \hline Flow & 1 & srcip & Nominal & Content & 25 & trans\_depth & Integer \\  & 2 & sport & Integer & & 26 & res\_bdy\_len & Integer \\  & 3 & dstip & Nominal & Time & 27 & Sjit & Float \\  & 4 & dsport & Integer & & 28 & Djit & Float \\  & 5 & proto & Nominal & & 29 & Stime & Timestamp \\ Basic & 6 & state & Nominal & & 30 & Ltime & Timestamp \\  & 7 & dur & Float & & 31 & Sintpkt & Float \\  & 8 & sybytes & Integer & & 32 & Dintpkt & Float \\  & 9 & dbytes & Integer & & 33 & Tcprtt & Float \\  & 10 & sttl & Integer & & 34 & Synacj & Float \\  & 11 & dttl & Integer & & 35 & Ackdat & Float \\  & 12 & sloss & Integer & General & 36 & Is\_sm\_ips\_ports & Binary \\  & 13 & dloss & Integer & Purpose & 37 & Ct\_state\_tl & Integer \\  & 14 & service & Nominal & & 38 & Ct\_fhw\_http\_mthd & Integer \\  & 15 & Sload & Float & & 39 & Is\_ftp\_login & Binary \\  & 16 & Dload & Float & & 40 & Ct\_ftp\_cmd & Integer \\  & 17 & Spkts & Integer & Connection & 41 & Ct\_sr\_src & Integer \\  & 18 & Dpkts & Integer & & 42 & Ct\_sr\_dst & Integer \\ Content & 19 & swin & Integer & & 43 & Ct\_dst\_ltm & Integer \\  & 20 & dwin & Integer & & 44 & Ct\_src\_ltm & Integer \\  & 21 & stcpb & Integer & & 45 & Ct\_src\_dport\_ltm & Integer \\  & 22 & dtcpb & Integer & & 46 & Ct\_dst\_sport\_ltm & Integer \\  & 23 & smeansz & Integer & & 47 & Ct\_dst\_src\_ltm & Integer \\  & 24 & dmeansz & Integer & & 48 & Attack\_cat & Nominal \\  & & & & 49 & Class & Binary \\ \hline \hline \end{tabular}
\end{table} 
Table 2: UNSW-NB15 Features with their data type and category. Attack types marked 2-10 in the table represent specific types of attacks, while the type marked 1 is normal network traffic.