## 4 Proposed Method
### Fitness Function  
The core of WOA is to find the best solution set in a finite solution set space through a finite number of iterations. The fitness function is the standard to evaluate whether a solution set is excellent. Therefore, how to set up an appropriate fitness function is the key to solve the problem of hierarchical clustering using WOA. The selection of the fitness function in this paper mainly considers the following three factors: the number of alarms contained in the cluster center, the distance between alarms belonging to the same cluster, and the coincidence degree between clusters. We believe that, given a fixed threshold of alarm distance, the more alarms that a cluster contains, the greater the fitness value will be. In addition, when the similarity of alarms belonging to the same cluster is higher (the distance is smaller), the fitness value is higher. If the coincidence degree of cluster center is higher, we believe that the meanings of the two clusters are closer, and the overall fitness value will be smaller. For a given alarm cluster center, \(S=(N_{1},N_{2},N_{3},N_{4},\ldots N_{m})\), where the value of m corresponds to the number of hierarchical trees used in the alarm cluster. If the alarm distance meets the number of alarms within the given threshold, we believe that the fitness of the alarm cluster center is higher. In Refs. [45; 46; 47], the setting of the fitness function is to determine whether the number of alarms belonging to a certain alarm cluster center exceeds the given threshold. If the number exceeds, the fitness is set to 1, and if not, the fitness is set to 0. This processing method has a simple idea and can well distinguish the alarms that do not meet the clustering requirements from those that meet the clustering requirements. However, the problem is that the method cannot reflect the quality of the cluster centers which exceed the threshold value. For example, if the threshold value is set to 500, the existing two clusters \(C_{1}\) and \(C_{2}\) contain alarm numbers of 2000 and 5000, respectively. We intuitively feel that \(C_{2}\) is better than \(C_{1}\) but their fitness values are set to the same value, which does not achieve a good distinction. In this paper, a new calculation method of alarm number fitness is adopted, as shown in Equation (10). \[E_{T}k(t,x)=\left\{ \begin{array}{c}0,if(x<t)\\ ln\big{(}\frac{x}{t}\big{)},if(x\geq t)\end{array} \right. \tag{10}\]  
where \(t\) represents the threshold of the number of alarms that the cluster should contain, and \(x\) represents the number of alarms belong to the cluster center. When \(x<t\), we think that the cluster contains too few alarms, and the cluster center should not be selected; when \(x>t\), we think that the fitness value of the cluster center increases with the increase in \(x\), and taking \(t=500\) as an example, the image of the fitness function is shown in Figure 8.  
Figure 7: Three cluster centers and its corresponding coding scheme: **(a)** the coding scheme of the three cluster centers; **(b)** three cluster centers (A4,B2,C3), (A1,B1,C2) and (A3,B2,C4). For a cluster center, only considering the number of alarms contained in the cluster center as an evaluation index cannot indicate the quality of the cluster center. Only when the number of alarms contained in the cluster center is large enough and the difference between alarms is small enough do we believe that the selection of the cluster center is reasonable. Therefore, we define a fitness function for the internal differences in the alarm cluster center, as shown in Equation (11). The average depth of the four hierarchical trees as shown in Figure 1 is \((3+2+3+2)/4=2.5\).