# A Power Monitor System Cybersecurity Alarm-Tracing Method Based on Knowledge Graph and GCNN
## 4 Conclusions  
To address the issues of intelligence, precision, and sample imbalance in the current cybersecurity tracing process of power monitoring systems, this paper proposes a power monitor system cybersecurity alarm-tracing method based on KG and GCNN. There are three main contributions in the paper. First, KG, based on a massive PowerCyberSec alert, is constructed. It takes the IP, devices, etc., as nodes and constructs a KG with 12,000 nodes to accurately represent massive alarm information. Additionally, it provides accurate input data for subsequent traceability. Second, a precise tracing method for PowerCyberSec alerts using GCNN and attention mechanisms is applied to sufficiently extract the topological features along alarms in KG so that it can precisely and effectively trace the massive alarms. It constructs an input-output feature module integrating PowerCyberSec KG to extract adjacency and feature matrices. By analyzing the relationship between nodes and relationships, alarms can be accurately traced. Third, the error-ambiguity decomposition strategy for PowerCyberSec alert sample imbalance is proposed. It introduces a low-frequency sample enhancement module using oversampling and an ensemble tracing module that optimally selects learners based on error-diversity matrices. Combined with KG techniques, this method enhances tracing accuracy for infrequent alerts. However, several limitations should be acknowledged. First, the scalability of the current model may be constrained when applied to large-scale power grids with millions of nodes, due to the computational complexity of graph-based learning. Second, the performance of the model heavily depends on the quality and completeness of the KG, including the correctness of entity relations and the coverage of historical alarm data. Third, while the attention mechanism provides some interpretability by highlighting important neighbors during aggregation, the overall model interpretability remains limited, particularly compared to rule-based or symbolic reasoning approaches. Looking ahead, future work can explore several promising directions. These include integrating temporal information into the KG to support dynamic alarm tracing, incorporating additional modalities such as log data and network traffic for richer contextual analysis, and investigating lightweight GCNN architectures for real-time deployment in large-scale power monitoring environments. Furthermore, the application of reinforcement learning or active learning could be explored to continuously improve the system's adaptability and reduce dependency on labeled data. Conceptualization, J.Y., M.G. and Z.Y. ; methodology, T.M. ; software, T.M. and M.G. ; validation, B.W., J.Y. and T.M. ; formal analysis, T.M. and M.G. ; investigation, B.W. ; resources, Y.L. and M.F. ; data curation, T.M. ; writing--original draft preparation, T.M. ; writing--review and editing, J.Y. and Z.Y. ; visualization, T.M. ; supervision, J.Y. and Z.Y. ; project administration, J.Y. and Z.Y. ; funding acquisition, Y.L. and M.F. All authors have read and agreed to the published version of the manuscript. \begin{table}
\begin{tabular}{c c} \hline \hline
**Test Set Size** & **Traceability Time/S** \\ \hline
150 alert messages & 86.87 \\
8760 alert messages & 169.78 \\
15,760 alert messages & 187.42 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: M0 Traceability Efficiency Under Different Test Set Sizes. **Funding:** This research is supported by the Autonomous Region Key Research and Development Plan Project (2023B01007-2). **Institutional Review Board Statement:** Not applicable. **Informed Consent Statement:** Not applicable. **Data Availability Statement:** The datasets presented in this article are not readily available because these data form part of an ongoing research project. Requests to access the datasets should be directed to T.M. **Conflicts of Interest:** Authors [PERSON] and [PERSON] were employed by the company The State Grid Xinjiang Electric Power Co., Ltd.