# A Power Monitor System Cybersecurity Alarm-Tracing Method Based on Knowledge Graph and GCNN
## 1 Introduction
However, prior work that combined KGs with traditional machine learning models (e.g., KG + SVM) or even CNN-based feature extraction (KG + CNN) has faced limitations in fully exploiting the topological structure of the KG. These approaches typically treat subgraphs as independent instances or use shallow feature extractors, which fail to capture deep relational patterns across multiple hops in the graph. To address these shortcomings, this paper proposes a novel integration of KG with graph convolutional neural networks (GCNNs) enhanced by attention mechanisms, enabling end-to-end learning over the graph-structured alert data. Unlike previous methods, our approach directly operates on the graph topology, extracting hierarchical and contextual features from multi-hop neighborhoods. Moreover, the attention mechanism allows the model to dynamically weigh the importance of different neighbors during feature aggregation, leading to more accurate and interpretable alarm tracing. In real-world PowerCyberSec data, specific alert causes, such as equipment operations or regional alerts, occur with very low probability, leading to imbalanced training samples. This imbalance causes GCNN or GAT to be biased towards more common alert causes, resulting in lower accuracy in alert tracing. To address this issue, oversampling and ensemble learning techniques are widely used to handle sample imbalance problems. Oversampling techniques increase the proportion of underrepresented samples by augmenting them [21]. At the same time, based on the error-ambiguity decomposition theory, ensemble learning adaptively selects the optimal base learners. It assigns higher weights to those better at identifying low-proportion samples [22]. These methods provide effective solutions for addressing sample imbalance. To this end, this paper relies on the knowledge in historical alarm data, constructing a cybersecurity domain-informed knowledge graph. It can freeze the cybersecurity experience and construct the alarm-tracing knowledge. Then, construct a cybersecurity tracing GCNN, with the advantage of GCNN's ability to process complex graph information. It is capable of conducting traceability analysis on the alarm information solidified in the form of graphs in KG. Considering that the imbalance of alarm data in the actual working process leads to the tendency of the traceability agent, a specialized data process and model ensemble strategy is proposed. The contributions of this article are as follows: the alarm traceability was conducted for 70,107 word-form PowerCyberSec alarm information provided by an actual power company, and the accuracy rate reached 96.59%. 1. A cybersecurity domain-informed knowledge graph is constituted based on the historical alert. By taking advantage of the knowledge graph's ability to solidify information, entities are used to represent the sites, IPs, and other information in the alarm information. The relationships between information are represented in the form of entity links, achieving the solidification of knowledge and manual processing experience in the alarm information. When facing a massive influx of alerts, achieve rapid analysis of the alerts. 2. A cybersecurity alarm-tracing GCNN is constructed. It takes advantage of the GCNN's strength in graph data analysis and processing to conduct traceability analysis on the knowledge information from alerts solidified by KG, achieving accurate traceability of alarm causes. 3. A specialized data process and model ensemble strategy by an adaptively weighted imbalance sample is proposed. In order to mitigate the influence of imbalanced alarms for tracing. It introduces an oversampling enhancement module and an ensemble tracing module based on error-diversity matrices, significantly improving the traceability accuracy of alarm and early warning.