# A Power Monitor System Cybersecurity Alarm-Tracing Method Based on Knowledge Graph and GCNN
## 2 Materials and Methods
### Cybersecurity Alarm-Tracing GCNN
#### 2.2.2 Cybersecurity Alarm Tracing  
For the input-output feature construction module that integrates a cybersecurity domain-informed KG. Firstly, an adjacency matrix \(A^{(k)}\) and a feature matrix \(X^{(k)}\) are generated for each of the \(m_{\text{sample}}\) alert messages, where \(k=1,\cdots,\)\(m_{\text{sample}}\). Secondly, a one-hot encoding technique is used to vectorize the \(m_{\text{alert}}\) types of alert reasons, resulting in an \(m_{\text{alert}}\)-dimensional alert label vector \(Y^{(k)}_{\text{label}}=[0,\)\(\cdots,1,\cdots,0]\), where the \"1\" is located at the \(l\)-th dimension, indicating that it belongs to the \(l\)-th type of alert reason, with \(l=1,\cdots,\)\(m_{\text{alert}}\). The adjacency matrix \(A^{(k)}\), feature matrix \(X^{(k)}\), and alert label  
Figure 3: Efficient and Accurate Intelligent Traceability Method Framework. vector \(Y_{\text{Label}}^{(k)}\) corresponding to the alert information together form the sample set for the PowerCyberSec alert tracing GCNN. The feature extraction module addresses the fact that traditional deep learning methods, which take vectors as input, cannot fully utilize the graph information from PowerCyberSec alerts. This is achieved by constructing a multi-layer GNN with an integrated attention mechanism. First, this subsection constructs a feature extraction module based on \(m_{\text{GCN}}\) layers of graph convolutional layers. Each graph node's initial feature dimension is \(n_{\text{dim}}\), and the feature dimension output by each layer is \(n_{\text{GCN}}^{(i)}\), where \(i=1,\cdots,\ m_{\text{GCN}}\). The forward propagation process is shown in Equation (7). \[H_{\text{GCN}}^{(i,k)}=\text{ReLU}(A^{(k)}(H_{\text{GCN}}^{(i,k)}W_{\text{GCN} }^{(i)})+b_{\text{GCN}}^{(i)}) \tag{7}\]  
\(H_{\text{GCN}}^{(i-1,k)}\) is the output of the \(i\)-th layer feature matrix. When \(i=1\), \(H_{\text{GCN}}^{(i-1,k)}=X^{(k)};W_{\text{GCN}}^{(i)}\) is the weight matrix of the \(i\)-th layer in the GCN, with dimensions \(n_{\text{GCN}}^{(i-1)}\times n_{\text{GCN}}^{(i)}\). When \(i=1\), \(n_{\text{GCN}}^{(i-1)}=n_{\text{dim}};b_{\text{GCN}}^{(i)}\) is the bias of the \(i\)-th layer in the GCN, with dimensions \(1\times n_{\text{GCN}}^{(i)}\). To further consider the varying importance of different types of entities, such as sites, IPs, and devices in alert information during traceability analysis, a graph attention mechanism-based neural network for PowerCyberSec traceability feature extraction is designed. In each layer of the graph convolutional network, attention parameters \(a^{(i)}\) with dimensions \(n_{\text{GAT}}^{(i)}\) are added. These parameters dynamically assign attention weights \(a_{\text{score}}^{(i,k)}\) to entities such as sites, IPs, and devices during the feature extraction process, as shown in Equation (8). Combining this with Equation (7), the forward propagation expression for the PowerCyberSec alert information feature extraction graph attention network is obtained, as shown in Equation (9). Ultimately, it outputs a feature matrix \(H_{\text{GAT}}^{(m_{\text{GAT}},k)}\) with dimensions \(n_{\text{entity}-k}\times n_{\text{GAT}}^{(m_{\text{GAT}})}\), achieving precise feature extraction from PowerCyberSec alert graph information. \[a_{\text{score}}^{(i,k)}=\text{Softmax}(\text{Leaky\_ReLU}(H_{\text{GAT}}^{(i- 1)}W_{\text{GAT}}^{(i)}a^{(i)})) \tag{8}\]  
\[H_{\text{GAT}}^{(i,k)}=\text{ReLU}((A^{(k)}\cdot a_{\text{score}}^{(i,k)})H_{ \text{GAT}}^{(i,k)}+b_{\text{GAT}}^{(i)}) \tag{9}\]  
The PowerCyberSec alert cause traceability module achieves precise traceability of alert causes by constructing a global pooling layer and multi-layer fully connected networks for PowerCyberSec alert feature matrices. First, a global pooling layer is built for the PowerCyberSec alert feature matrix to reduce dimensionality.