# A Power Monitor System Cybersecurity Alarm-Tracing Method Based on Knowledge Graph and GCNN
## 2 Materials and Methods
### Cybersecurity Domain-Informed Knowledge Graph Construction
#### 2.1.3 Cybersecurity Knowledge Embedding  
(Step 3) Finally, a knowledge graph is constructed using the Neo4j database. If a certain entity does not exist in the graph, a new node is used to represent the entity. In KG, the system checks whether there is a relationship between the head and tail entities specified in the triplet. If there is no relationship between these two entities, a new connection is created to represent this relationship. By iterating through all PowerCyberSec alert text triples, the Neo4j database constructed a cybersecurity domain-informed knowledge graph, achieving the solidification of alert information knowledge.  
Considering that the input data in text form cannot be used as the input of the neural network, the embedding method is adopted to vectorize the knowledge in text form.  
Traditional embedding models like TransE represent entities' feature vectors \(e_{i}\) (the head entity, relation, and tail entity in a triple) as vectors \(e_{h}\), \(r\), and \(e_{t}\), respectively [23]. The operations between these vectors are shown in Equation (1).  
\[e_{h}+r=e_{t} \tag{1}\]  
However, in PowerCyberSec alert information, there are numerous one-to-many (\(e_{h}\), \(r\), \(e_{t}\), \(i\)) (\(i=1,\cdots,n_{\text{tail}}\)) and many-to-one (\(e_{h,i}\), \(r\), \(e_{t}\)) (\(i=1,\cdots,\)\(n_{\text{head}}\)) types of triples. According to Equation (1), traditional flat translation models would represent \(e_{h,i}\) as the same head entity vector \(e_{h}\) and \(e_{t,i}\) as the same tail entity vector \(e_{t}\), leading to incorrect representation of alert entities. Therefore, we construct the PowerCyberSec embedding model based on TransH. The operations between entity vectors and relation vectors in the spatial knowledge embedding model are shown in Equations (2)-(4).  
\[e_{h}^{\prime}+r^{\prime}\approx e_{t}^{\prime} \tag{2}\]  
\[e_{h}^{\prime}=e_{h}-w_{r}^{T}e_{h}w_{r} \tag{3}\]  
\[e_{t}^{\prime}=e_{t}-w_{r}^{T}e_{t}w_{r} \tag{4}\]  
In the spatial knowledge embedding model, each relation \(r\) corresponds to a hyperplane, with its projection on the hyperplane denoted as \(r^{\prime}\). The normal vector of the hyperplane is \(w_{r}\). As shown in Equations (3) and (4), the original vectors of the head entity \(e_{h}\) and the tail entity \(e_{t}\) are projected onto the hyperplane along \(w_{r}\) to obtain the projected vectors \(e_{h}\) and \(e_{t}\). The relationship between \(e_{h}\), \(e_{t}\), and \(r^{\prime}\) is given by Equation (2). For one-to-many triples (\(e_{h}\), \(r\), \(e_{t,i}\)), different tail entity vectors \(e_{t,\ i}\) are projected onto the same vector \(e_{t}^{\prime}\) on the hyperplane. For many-to-one triples (\(e_{h,i}\), \(r\), \(e_{t}\)), different head entity vectors \(e_{h,i}\) are projected onto the same vector \(e_{h}^{\prime}\) on the hyperplane. This approach satisfies the operations between entity vectors and relation vectors as described in Equation (1), while avoiding the incorrect representation of head entities \(e_{h,i}\) and tail entities \(e_{t,i}\) as the same vectors \(e_{h}\) and \(e_{t}\) in traditional flat translation models.