## 4 Proposed Method
### WOA-Based Alarm Hierarchical Clustering Process
Meanwhile, in order to compare with other algorithms, we repeat the alarm clustering algorithm mentioned in the references [45; 46; 47] and compare it with WOAHC-L. In order to more intuitively feel the results of clustering, we use the number of alarms contained in the cluster center as the Y axis to compare the four algorithms. Please note that it is not accurate to rely only on the number of clusters contained in the cluster center to evaluate the quality of the clustering results. The quality of the clustering results is also greatly related to the distance between the alerts contained in the cluster center (called difference

Figure 16: Time consuming and alarm clustering results versus the execution times of WOAHC-L.

in some works), that is, the fitness function mentioned in the formula. The experimental results are shown in Figure 17.

As can be seen from Figure 17, compared with [PERSON]'s algorithm, SA and GA, WOAHC-L can well jump out of the local optimum in the process of clustering search, while other algorithms begin to converge at the beginning or middle of the iteration and no longer search for a better cluster center. We need to emphasize that the purpose of this experiment is to intuitively show that compared with the other three algorithms, WOAHC-L can better jump out of the local optimal and achieve better results when carrying out hierarchical clustering. A more detailed comparison of experimental results with other algorithms is presented in the following experiments. We use the following formula to calculate the values of these indicators. \[Accuracy=\frac{TP+TN}{TP+FP+TN+FN} \tag{14}\]

\[Precision=\frac{TP}{TP+FP} \tag{15}\]

\[Recall=\frac{TP}{TP+FN} \tag{16}\]

where \(TP\) represents the number of normal network traffic clustering to normal cluster, \(TN\) represents the number of network attack clustering to attack cluster, \(FP\) represents the number of network attack alarms incorrectly clustering to normal cluster, \(FN\) represents the number of normal network traffic incorrectly clustering to the attack cluster. \(Accuracy\)

Figure 17: Comparison of experimental results between WOAHC-L and [PERSON]’s method, SA and GA. \begin{table}
\begin{tabular}{c c c c c c c c c c c c} \hline \hline
**Time Rounds** & **1** & **2** & **3** & **4** & **5** & **6** & **7** & **8** & **9** & **10** & **11** & **Time Consuming** \\ \hline
1 & 18,433 & 14,870 & 3219 & 6553 & 4170 & 745 & 421 & 921 & 31 & 29 & 51 & 66.3 s \\
2 & 38,923 & 4331 & 3490 & 993 & 671 & 210 & 78 & 32 & & & 52.0 s \\
3 & 36,544 & 4370 & 4921 & 2008 & 719 & 198 & 43 & 23 & 104 & 97 & & 56.5 s \\
4 & 24,003 & 18,995 & 4109 & 529 & 899 & 32 & 390 & 241 & 45 & 122 & & 55.3 s \\
5 & 15,023 & 30,901 & 2104 & 2233 & 920 & 320 & 429 & 290 & 102 & & & 63.4 s \\ \hline \hline \end{tabular}
\end{table} 
Table 5: The results of the number of alarms contained in the cluster and the number of algorithms calls in five experiments. represents the accuracy of the clustering; _Precision_ represents how much of the data clustered as normal traffic are really normal traffic; and _Recall_ represents how much of the normal traffic is correctly clustered. Table 6 shows the comparison of various indicators of different algorithms. These indicators have specific meanings, introduced in Table 1.

As can be seen from Table 6, WOAHC-L is obviously superior to other algorithms in terms of the number of clustering, number of remaining alarms, accuracy, precision and recall. It should be noted that recall refers to the rate of aggregation of false alarms, or reduction in redundant alarms. However, WOAHC-L has obvious deficiencies in terms of time consumption, which is caused by the multi-search agent mechanism of the WOA and the calculation of the fitness value. As the excellent performance of WOAHC-L in alarm reduction is proved by comparing with other algorithms, we explore the stability of WOAHC-L in clustering and the rule analysis of clustering results.