## 4 Proposed Method
### WOA-Based Alarm Hierarchical Clustering Process
As can be seen from the number of alarms in cluster 1 to cluster 3, the global clustering version using WOAHC-G can effectively eliminate the problem of excessive cluster repetition. However, the problem of the global clustering version is that it is difficult to determine an appropriate number of cluster centers. In this round of experiments, we set the number of cluster centers to 8 according to the experience of WOAHC-L to eliminate the impact of this problem. However, how to determine an appropriate number of cluster centers requires further research and analysis in the future. Finally, we discuss the time complexity of the proposed algorithm framework. It is assumed that WOAHC eventually generates \(C\) clusters, with a total of \(M\) alarms to be clustered, the maximum iteration time of the algorithm is \(T\), there are \(N\) search agents searching the solution set space at the same time, and each hierarchical tree has \(m\) nodes. For WOAHC-L, the time complexity of calculating the fitness value is \(O(M+log_{2}m)\), so the total time complexity of the algorithm is \(O(C*T*N*(M+log_{2}m))\). During our experiment, \(N\) threads are used to search \(N\) search agents at the same time, so the time complexity can be optimized to \(O(C*T*(M+log_{2}m))\). For WOAHC-G, the time complexity of calculating the fitness value is \(O\big{(}log_{2}m+M+C^{2}\big{)}\), so the overall time complexity is \(O\big{(}T*N*\big{(}log_{2}m+M+C^{2}\big{)}\big{)}\), and the time complexity after multithreading optimization is \(O\big{(}T*\big{(}log_{2}m+M+C^{2}\big{)}\big{)}\). Figure 18: Comparison of the final results of eight experiments. ## 6 Conclusions and Future Work

In previous studies, in order to solve the problem of a large number of redundant alarms generated by IDS, some scholars proposed the hierarchical alarm clustering algorithm. With the development of the swarm intelligence optimization algorithm, the WOA has been widely used to solve various optimization problems. In this paper, we propose two new methods to solve the problem of alarm reduction by applying the WOA to hierarchical clustering, namely WOAHC-L and WOAHC-G. Through experiments on the UNSW-NB data set, we prove that WOAHC-L can solve the problems of the clustering falling into the local optimum and the poor clustering quality well. Experimental results show that WOAHC-L can achieve 95.2% clustering accuracy and reduce redundant alarms by 96.1%. Compared with WOAHC-L, which generates more than 11 clusters, WOAHC-G reduces the problem of clustering overlap by generating 8 accurate clusters. Although our new method achieves good results in dealing with redundant alarms, it still has some limitations. For example, WOAHC-L can solve the problem of premature convergence in the clustering process well, but it is easy to produce an excessive number of repeated clusters. WOAHC-G solves this problem well, but it requires the space size of multiple orders of magnitude to encode the hierarchical tree. Meanwhile, WOAHC-G requires a prior number of clusters to ensure that the clustering is not repeated, which will make it difficult to deal with real network problems. Future work will consider shifting the focus of work to the processing of security events in the real network environment and studying how to adjust a more excellent fitness function to obtain more accurate clustering. In addition, the adaptive setting of the clustering number of WOAHC-G will also be a key point of future work. All authors contributed to this manuscript. Conceptualization, L.W. ; methodology, L.W. ; data curation, L.W. ; supervision L.G. ; validation, L.G. and Y.T. ; resources, L.G. ; writing--original draft preparation, L.W. ; writing--review and editing, L.G., Y.T. All authors have read and agreed to the published version of the manuscript. This research received no external funding. Not applicable. **Data Availability Statement:** Publicly available datasets were analyzed in this study.