# A Power Monitor System Cybersecurity Alarm-Tracing Method Based on Knowledge Graph and GCNN
## 2 Materials and Methods
### Tracing Method for Powercybersec Alerts Considering Sample Imbalance
#### 2.3.1 Error-Ambiguity Decomposition Strategy  
The sample imbalance handling strategy proposed in this subsection consists of two modules: enhancement of low-proportion cause samples for PowerCyberSec alerts and integrated tracing of PowerCyberSec alerts. The framework is illustrated in Figure 4.  
The PowerCyberSec low-ratio cause sample augmentation module enhances the proportion of low-ratio alert causes in the dataset by constructing oversampling and bootstrapping strategies. First, the PowerCyberSec alert text dataset is transformed into an input-output feature set \(T\). Therefore, \(T\) is divided proportionally into a training set \(T_{\text{train}}\) and a test set \(T_{\text{test}}\). The samples \(T_{\text{low}}\) corresponding to low-ratio alert causes in \(T_{\text{train}}\) are then oversampled to generate an oversampled dataset \(T^{\prime}_{\text{low}}\). Next, the bootstrapping algorithm is applied to \(T^{\prime}_{\text{low}}\) and other cause datasets \(T_{\text{normal}}\) for sampling with replacement, generating \(m_{\text{base}}\) subsets \(T^{(k)}_{\text{train}}\) needed for training base models, where \(k=1,\ \cdots,\ m_{\text{base}}\). The PowerCyberSec alert integrated traceability module enhances the overall model's accuracy in tracing low-ratio alert causes by employing a base model selection strategy based on error-diversity decomposition theory and a method for calculating base model weights that considers the traceability of low-ratio samples. First, the PowerCyberSec alert feature extraction and traceability module is used as the base learner, combined with bagging ensemble learning to obtain \(m_{\text{base}}\) PowerCyberSec traceability base models \(h_{k}\), where \(k=1,\cdots,\ m_{\text{base}}\)[24]. For PowerCyberSec alert samples, \(A^{(k)}\), \(X^{(k)}\), \(Y^{(k)}_{\text{pre}}\) are the traceability results obtained from the \(k\)-th PowerCyberSec alert traceability base model \(h_{k}\), i.e., \(Y^{(k)}_{\text{pre}}=\ h_{k}(A^{(k)},X^{(k)})\). Next, a base model selection strategy based on error-diversity decomposition theory is proposed to adaptively select s-base models with high accuracy and diversity from the \(m_{\text{base}}\) base models, as shown in Equations (11) and (12). An optimal adaptive selection model is established to optimally and adaptively select s-base models. \[P_{kj}=\left\{ \begin{array}{c}0,\text{ Other cases}\\ 1,\ h_{k}\text{ correctly identifies sample }x_{j}\end{array} \right. \tag{11}\]  
\[\underset{r}{\text{min}}r^{T}Gr \tag{12}\] \[s.t.\ \underset{i=1}{\overset{n}{\sum}}r_{k}=s,r_{k}\in\{0,1\}\]Furthermore, a method for calculating the weights of base models is proposed, considering the traceability capability for low-ratio causes. This method assigns higher weights to base models with stronger traceability capabilities for low-ratio causes. As shown in Equation (13), the traceability accuracy of \(s\)-base models for \(m_{\text{low}}\) types of low-ratio causes are calculated, resulting in an \(s\)-dimensional base model weight vector \(w_{s}\). \[{w_{s}}^{(k)}=\frac{1}{m_{\text{low}}}\sum_{l=0}^{m_{\text{low}}}\text{acc}^{( k,l)} \tag{13}\]  
\({w_{s}}^{(k)}\) represents the weight of the \(k\)-th base model; \(\text{acc}^{(k,l)}\) represents the prediction accuracy of the \(k\)-th base model for the \(l\)-th type of low-ratio alert cause; \(k=1,\cdots,s;l=1,\cdots,\ m_{\text{low}}\). Finally, the weighted voting method is used to generate an \(m_{\text{alert}}\)-dimensional prediction vector _result_ for the \(m_{\text{alert}}\) types of PowerCyberSec alert causes, as shown in Equation (14). According to Equation (15), the alert result \(Y_{\text{result}}\) is determined by selecting the category with the highest value in the prediction vector. \[result=\sum_{i=1}^{s}{w_{s}}^{(k)}\gamma_{\text{pre}}^{(k)} \tag{14}\]  
Figure 4: Strategy Framework for Dealing with Unbalanced Problems.