## 4 Experiment and Discussion
### Experimental Setup  
**Baseline Methods** We compare our proposed method with the static KGE and TKGE models in the previous study. The static KGE methods used in this article are TransE [10], DistMult [16], Temporal methods include TTransE [20], HyTE [21], TA-DistMult [5].  
**Evaluation Protocol** According to the previous work [29], we filtered out the triplet data that meets our experimental requirements from these four Industrial Internet of Things data sets, and divided them into training sets, verification sets, and test sets according to the characteristics of the data, which are 80%/10%/10%, respectively [47; 48; 49; 50]. We report the average countdown ranking (MRR) and Hits@1/3/10 (the proportion of correct test cases in the top 1/3/10) to measure the performance of our model and the comparison model [51; 52; 53; 54; 55]. The calculation formula of MRR is as follows:  
\[MRR=\frac{1}{|S|}\sum_{i=1}^{|S|}\frac{1}{rank_{i}}=\frac{1}{|S|}\Bigg{(}\frac {1}{rank_{1}}+\frac{1}{rank_{2}}+\cdots+\frac{1}{rank_{|S|}}\Bigg{)} \tag{6}\]  
where \(S\) is the set of triples, \(|S|\) is the number of triples, and \(\mathbb{\{}rank\ \mathbb{\}}\)_i_ refers to the link prediction ranking of the \(i\)-th triplet.  
HITS@n refers to the average proportion of triples ranked less than n in the link prediction [56; 57]. The specific calculation method is as follows:  
\[\textbf{HITS@}n=\frac{1}{|S|}\sum_{i=1}^{|S|}\mathbb{I}(rank_{i}\leq n) \tag{7}\]  
where the symbols involved in the above formula are the same as those involved in the MRR calculation formula, and I (\(\cdot\)) is the indicator function (if the condition is true, the function value is 1, otherwise it is 0). n usually takes the values of 1, 3, and 10.  
**Model configuration** Exclude empty accounts that have not been used for a long time in the MOOC-Ub data set, and use the filtered triples and time for verification. The coefficient \(\alpha\) is adjusted from 0.1 to 0.9, with a step size of 0.1. The batch size is set to 1024.The training epoch is limited to 50, which is sufficient to converge in most cases. The embedding dimension is set to 200 to be consistent with the setting of [PERSON] et al. [30]. The baseline results are also from [PERSON] et al. [30].  
**Selection of data in Edge-IiOTest dataset** Since the Edge-IiOTest dataset not only contains the data described in Section 4.1, it also contains 61 flow features and two new attributes, which are stored together in a CSV file. We use python programs to extract the data information we need from it, including: The IP addresses of the network attacker  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline \(\mathbf{\sharp}\)**Dataset** & **BPLP** & **MOOC-Ub** & **NFT** & **IE-IoTD** & **Edge-IiOTest** \\ \hline \#Entities & 3024 & 24,100 & 5422 & 12,564 & 108,576 \\ \#Relation & 145 & 274 & 186 & 245 & 14 \\ \#Training & 7213 & 19,151 & 7274 & 18,780 & 24,301 \\ \#Validation & 5327 & 7263 & 4263 & 4072 & 19,281 \\ \#Test & 3348 & 2854 & 1000 & 2349 & 4820 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Summarizes the statistics of the dataset.  
and the attacked sensor, the attack methods of different attackers on the sensor, and the time when the network attack started and ended. We regard the attacker's IP address as the subject entity set, the attacked sensor (IP address) as the object entity set, and the attack method as the predicate relationship set. The above data sets are used to form triples of knowledge graphs. Due to the different time units of network attacks (milliseconds, seconds, minutes, and hours), therefore, the time data is dimensionless. Use the Z-score normalization method:  
\[t_{b^{*}}=\frac{t_{b}-\mu_{b}}{\sigma_{b}},t_{e^{*}}=\frac{t_{e}-\mu_{e}}{ \sigma_{e}} \tag{8}\]  
where \(\mu_{b}\) and \(\mu_{e}\) are the mean values of \(t_{b}\) and \(t_{e}\) of the same time unit category, respectively. \(\sigma_{b}\) and \(\sigma_{e}\) are the standard deviations of \(t_{b}\) and \(t_{e}\) in the same time unit category, respectively.