An Unsupervised Approach for False Alarm Filtering in Rule-based NIDS