# Ransomware Detection Model Based on Adaptive Graph Neural Network Learning +
## 3 Methodology
As depicted in Figure 7, our findings reveal that the accuracy initially escalates and subsequently declines with an increase in \(\alpha\), attaining a peak when \(\alpha\) is set to 35. ### Ablation Experiments

As depicted in Figure 8, we conducted a comparative analysis of various ransomware detection models, including the CNN-LSTM [45] hybrid, TextCNN [46], TextGCN [18], and LSTM [47] models. Initially, the CNN-LSTM hybrid model exhibits high accuracy, which, however, diminishes with an increase in the number of API call sequences. As the length of the API call sequences escalates, more sensitive API call functions emerge, thereby enhancing the model's detection accuracy. This trend persists until all sensitive API call functions are accounted for, at which point the network accuracy peaks at 0.966. Figure 8 illustrates that longer sequence lengths yield more precise results. Although the positive impact of increasing the sequence length eventually tapers off, ADC-TextGCN still outperforms the LSTM, CNN-LSTM hybrid, TextGCN, and TextCNN models in terms of accuracy. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Method**} & **Accuracy** & **Recall** & **Accuracy** & **Recall** & **Accuracy** & **Recall** \\  & **(E)** & **(E)** & **(M)** & **(M)** & **(U)** & **(U)** \\ \hline COIR-PMI & 0.932 & 0.903 & 0.924 & 0.893 & 0.907 & 0.890 \\ PMI & 0.914 & 0.876 & 0.903 & 0.882 & 0.894 & 0.867 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: COIR-PMI accuracy experiment. Figure 7: Results of \(\alpha\) factor experiment. The choice of these models for comparison is motivated by their status as classic models in the field of deep learning. Comparing ADC-TextGCN against these classic models provides a clear reference point for readers to understand the performance of our model. The comparison remains fair and meaningful, as all models were evaluated under the same conditions, even if the comparison models are not the latest. Furthermore, the choice of these widely available and easily understood models enhances the reproducibility of our experiments. The outcomes of the ablation experiment are delineated in Table 5. The results show a notable enhancement in accuracy with the combined application of the \(\alpha\) factor and COIR-PMI, resulting in an accuracy increase of approximately 6.8% for dataset E compared to the base model without any enhancements. Furthermore, the addition of the diffusion radius \(t\) leads to further incremental improvements, achieving an impressive accuracy rate of 96.6% on dataset E. Similar trends are observed on datasets M and U, with accuracy improving to 95.3% and 92.7% respectively when all factors are applied. These results underscore the comprehensive effectiveness of the ADC-TextGCN, which significantly outperforms the baseline and other existing methods in accuracy. Figure 9 shows the ablation studies under various diffusion settings. Graph Diffusion Convolution can be understood as fixing the heat kernel 't' with sparsification. The findings suggest that the efficacy of Graph Diffusion Convolution is partly due to its sparsification effect on the propagation matrix. Notably, if sparsification is removed, training the diffusion time parameter 't' for each feature channel and layer markedly outperforms merely fixing 't' to its initial value. By comparing the enhancements brought about by training 't' at different levels, Figure 9 also demonstrates that training 't' for each channel and layer makes the most contribution to the performance improvements in the node classification task. Figure 8: Comparison of different models.