# A Power Monitor System Cybersecurity Alarm-Tracing Method Based on Knowledge Graph and GCNN
## 2 Materials and Methods
### Tracing Method for Powercybersec Alerts Considering Sample Imbalance
#### 2.3.2 A Power Monitor System Cybersecurity Alarm-Tracing Method Based on Knowledge Graph and GCNN  
Based on the cybersecurity domain-informed knowledge graph, the cybersecurity alarm-tracing GCNN, and the model ensemble strategy, we can develop a power monitor system cybersecurity alarm-tracing method based on KG and GCNN. The specific steps are as follows:  
Step 1: Construct PowerCyberSec alert KG and vector library. Firstly, the PowerCyberSec alert sentences are split into word forms through knowledge extraction. Next, convert the word-form PowerCyberSec alert information into PowerCyberSec alert text triples and construct the KG. Finally, based on the PowerCyberSec alert text triples and KG, the TransH technology was used to vectorize the text information, achieving the solidification of the PowerCyberSec alert information.  
Step 2: Construct PowerCyberSec alert traceability training subsets \(T_{\text{train}}^{(k)}\) and test set \(T_{\text{test}}\). First, construct the matrix \(A\) and \(X\) according to Equations (1) and (2). Using the vectorized encoding method proposed to generate the alert label vectors, forming the input-output feature set \(T\) for PowerCyberSec alerts. Then, dividing the data into a PowerCyberSec alert traceability test set \(T_{\text{test}}\) according to a certain proportion. Using the oversampling strategy to augment the low-proportion cause samples from the remaining data in \(T\). Employ the bootstrapping algorithm to randomly sample and generate the training subsets \(T_{\text{train}}^{(k)}\) for the PowerCyberSec alert traceability model, where \(k=1,\cdots,\ m_{\text{base}}\).  
Step 3: Construct and train the base models for PowerCyberSec alert traceability based on GAT. First, construct \(m_{\text{base}}\) base models \(h_{k}\) for PowerCyberSec alert traceability. Each base model includes a feature extraction module based on \(m_{\text{GAT}}\) layers of graph attention layers and a traceability module based on global pooling layers and \(m_{\text{FCN}}\) layers of fully connected networks. Next, input \(A_{\text{train}}^{(k)}\) and \(X_{\text{train}}^{(k)}\) from the \(m_{\text{base}}\) training subsets \(T_{\text{train}}^{(k)}\) into the corresponding base traceability models to obtain the alert traceability vector subsets \(Y_{\text{pre}}^{(k)}\). Finally, using the binary cross-entropy loss function, calculate the loss between the alert label vectors \(Y_{\text{Label}}^{(k)}\) and the alert traceability vectors \(Y_{\text{pre}}^{(k)}\). Train the models using stochastic gradient descent optimization to obtain the weights \(W\), biases \(b\), and attention parameters \(a\) for each network structure, thereby completing the training of the \(m_{\text{base}}\) base models \(h_{k}\).  
Step 4: Build a power monitor system cybersecurity alarm-tracing method based on KG and GCNN. First, construct the base model selection strategy proposed to select \(s\)-base models from the \(m_{\text{base}}\) traceability base models based on their higher accuracy and diversity. Next, using the base model weight calculation method that considers the traceability capability for low-proportion samples, compute the output weight vector \(w_{s}\) for the \(s\)-base models according to Equation (13). Finally, obtain the alert results \(Y_{\text{result}}\) of the integrated model using Equations (14) and (15), thereby completing the construction of the integrated intelligent tracing model for PowerCyberSec alerts.