# A Power Monitor System Cybersecurity Alarm-Tracing Method Based on Knowledge Graph and GCNN
## 2 Materials and Methods
### Cybersecurity Domain-Informed Knowledge Graph Construction
#### 2.1.2 Cybersecurity Knowledge Extraction  
(Step 1) Since the input of PowerCyberSec is a piece of text, it is necessary to segment the text segment object in combination with the semantic characteristics of the power system. In this paper, Jieba word segmentation is adopted to segment the alarm information in the form of text segments into word forms. The Jieba word segmentation library is utilized to conduct dictionary model matching and word segmentation for common words such as \"discovery\", \"policy\", and \"access\" in the PowerCyberSec alert information. In addition, a probabilistic model is adopted to segment industry-specific terms (such as the reserved addresses, ports, and substations in the PowerCyberSec alert information). For example, the segmentation result of \"Alarm Station\" is \"110/KV/xx/Substation\". These results provide input for the subsequent extraction of entities and relations.  
(Step 2) To construct the knowledge graph, triplet matching is carried out on the word-based alarm information obtained in step 1 based on the semantic characteristics of the alarm entities. There are two types of relationships between any two types of alarm entities: \"belong to\" and \"possess\". For example, a site \"belongs to\" a voltage level, a site \"owns\" a device, and an IP \"owns\" a port. Finally, based on the entities extracted from each alert message and the defined relationships, a PowerCyberSec alert text triplet in the format of (head entity, relationship, tail entity) is formed. Considering that there are only two types of relationships (\"own\" and \"belong\"), but for the massive entities of various types such as sites, devices, and Ips, there exist the following three types of alarm text triples: 1 One-to-one: (Substation A, belong, 110 KV), (Power Plant B, belong, 220 KV); 2 One-to-many: (10.70.xxx. Xxx, has, port A), (10.70.xxx. xxx, has port C); and 3 Many-to-one: (Wind farm C, belonging, 220 KV), (Solar power station D, belonging, 220 KV).  
(Step 3) Finally, a knowledge graph is constructed using the Neoj database. If a certain entity does not exist in the graph, a new node is used to represent the entity. In KG, the  
\begin{table}
\begin{tabular}{c c} \hline
**Information Category** & **Information Content** \\ \hline Alarm description & An access that does not comply with the security policy \\  & was found. The local address *.*.**.35 accessed port 123 of \\  & the remote address *.*.**.34 \\ \hline Alarm type & Access does not comply with security policies. \\ \hline Alarm site & A certain converter station \\ \hline Alarm equipment & Zone III Boundary Firewall \\ \hline Alarm reason & Routine Device Operation \\ \hline \end{tabular} The logic of artificial experience analysis in this example is as follows: *.*.*.35 is the local address of the remote motor in the substation, *.*.*.*.34 is the address of the configured remote server, and the destination ports of UDP 1, 2, and 3 are SNTP protocol ports. SNTP is a simple Network Time Protocol, mainly used to synchronize the time of computer systems in the network. The operation that causes the alarm here is the user’s daily access.  
\end{table}
Table 1: Alarm Content.  
system checks whether there is a relationship between the head and tail entities specified in the triplet. If there is no relationship between these two entities, a new connection is created to represent this relationship. By iterating through all PowerCyberSec alert text triples, the Neo4j database constructed a cybersecurity domain-informed knowledge graph, achieving the solidification of alert information knowledge.