# A Power Monitor System Cybersecurity Alarm-Tracing Method Based on Knowledge Graph and GCNN
## 1 Introduction  
The secure operation of power systems is the foundation and lifeline of national economic development. The cybersecurity of power monitoring systems serves as the guardian for the safe and stable operation of power systems [1]. Traditional power cybersecurity (referred to as PowerCyberSec) systems rely on expert experience to trace alert information and require practiced staff in monitoring centers to analyze and identify alerts' causes [2]. However, when faced with a large influx of alerts, manual judgment cannot achieve rapid tracing [3]. As power systems expand and more sensors are deployed, alert information has become increasingly complex and diverse [4, 5]. This deteriorates the drawbacks of relying heavily on human expertise in PowerCyberSec systems [6]. With the development of thepower system, the number of sites and IP addresses that need to be constantly monitored has increased exponentially. However, the number of personnel involved in the monitoring work cannot increase proportionally. As a result, the efficiency of each staff member in processing information has been greatly affected. Therefore, the PowerCyberSec system needs to be more intelligent to quickly and accurately identify the causes of alarms and provide references for handling various types of alarms. With the development of artificial intelligence, scholars suggest a tracing method based on AI technology, including machine learning and deep learning categories. Machine learning traces alarms by constructing artificial intelligence agents to learn the knowledge information. Deep learning enhances the traceability performance of machine learning by inputting big data information into artificial intelligence agents. Machine learning methods like SVMs have been applied to alert tracing studies [7]. As a popular research topic in new power systems, AI technology, with its efficient processing speed and independence from human assistance, offers new approaches to solving PowerCyberSec challenges [8; 9; 10]. These methods require fewer samples for training, feature simple model structures, and offer fast tracing speeds. However, refs. [11; 12] indicate that with the continuous expansion of the power grid scale, the deployment of new monitoring equipment, and the integration of intermittent clean energy, early warning information has become increasingly complex and massive. Simple-structured machine learning methods struggle to accurately trace alerts within big data, failing to meet current grid requirements. As for deep learning methods, they are adept at handling large datasets and address the limitations of machine learning in utilizing PowerCyberSec big data [12]. Researchers now employ deep learning methods like CNN [13; 14], LSTM [15; 16], GCN [17], and RNN [18] to trace power grid monitoring signals by vectorizing alert information and using vectorized PowerCyberSec big data as input, enhancing the accuracy of alert tracing systems. However, existing AI-based alarm-tracing approaches frequently suffer from two critical limitations:  
1. Inability to model relational knowledge among alarms, devices, and system states. 2. Poor generalization performance on rare alarm categories, due to imbalanced data distributions. Those intelligent methods still suffer from the complex structure of PowerCyberSec alert information. Vectorized inputs via CNN and similar methods cannot accurately or succinctly represent high-dimensional alert information, limiting the accuracy of tracing. In contrast, KG, which organizes data in a graph structure, offers more precise knowledge representation capabilities [19]. They can accurately characterize massive alert entities and succinctly represent relationships between entities. Therefore, it is necessary to develop research on constructing KG and deep learning that characterizes massive PowerCyberSec alert information [20].