# Ransomware Detection Model Based on Adaptive Graph Neural Network Learning +
## 3 Methodology
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{\(\alpha\) Factor} & \multirow{2}{*}{**COIR-PMI**} & **t** & **Accuracy** & **Recall** & **Accuracy** & **Recall** & **Accuracy** & **Recall** \\  & & **(t)** & **(E)** & **(E)** & **(M)** & **(M)** & **(U)** & **(U)** \\ \hline \(\times\) & \(\times\) & \(\times\) & 0.875 & 0.723 & 0.861 & 0.763 & 0.814 & 0.761 \\ \(\surd\) & \(\times\) & \(\times\) & 0.889 & 0.755 & 0.879 & 0.778 & 0.830 & 0.774 \\ \(\surd\) & \(\surd\) & \(\times\) & 0.943 & 0.907 & 0.932 & 0.898 & 0.913 & 0.882 \\ \(\surd\) & \(\surd\) & \(\surd\) & 0.966 & 0.914 & 0.953 & 0.903 & 0.927 & 0.902 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Ablation experiment. We divided ablation experiments into four distinct scenarios. Among the scenarios, (1) can be viewed as Graph Diffusion Convolution without sparsification. Results from

Figure 9: Ablation experiment: comparison of different training strategies. (1) Fixing ‘t’ to the initialization value. (2) Training a single ‘t’ for all layers. (3) Training a unique ‘t’ for each layer. and (4) Training a unique ‘t’ for each feature channel and layer. The experiments were conducted using three different datasets: (**a**) the Ember dataset, (**b**) the malware_api_class dataset, (**c**) and the UNSW-NB15 dataset. these experiments show that training the diffusion time parameter directly from the data significantly enhances performance, especially when sparsification is removed. Figure 10 presents the accuracy comparison between the traditional TextGCN methods and those enhanced with Graph Diffusion Convolution and Adaptive Diffusion Convolution strategies. It is evident from the figure that the Text Graph Convolutional Network utilizing the Graph Diffusion Convolution strategy significantly outperforms the traditional methods. Moreover, the ADC-TextGCN surpasses the version with the Graph Diffusion Convolution strategy applied. These results further validate the efficacy of our re-search findings and underscore the advantages of the ADC-TextGCN. To assess the impact of validation set size on model performance, a series of tests were conducted with various ratios between the training and validation sets while maintaining the same experimental conditions. The total number of nodes in the validation set remained unchanged, with only the distribution of nodes per class in the training set being adjusted. The outcomes of these tests are displayed in Figure 11. In most tested scenarios, ADC-TextGCN consistently outperforms both Graph Diffusion Convolution and the traditional TextGCN model. This indicates that the enhanced performance of ADC-TextGCN is not attributable to training additional parameters on a large validation set, but is inherent to its architectural design and learning approach. The experiments were conducted on three different datasets: (a) the Ember dataset, (b) the Malware API Class dataset, and (c) the UNSW-NB15 dataset. Figure 11 aims to ascertain whether the observed improvement results from the overuse of the validation set, and the results indicate that this is not the case. Thus, we can conclude that the ADC-TextGCN model's superior performance is not due to overfitting on the validation set. From the results in Figure 11, we can observe that (1) the ADC-TextGCN model demonstrates a clear advantage over the traditional TextGCN approach in terms of prediction accuracy. For example, in the UNSW-NB15 dataset, the ADC-TextGCN achieves an accuracy approximately 4.8% higher than the traditional TextGCN model. This suggests that the ADC-TextGCN is particularly effective in learning from global co-occurrence information. (2) The ADC-TextGCN also exhibits superior performance compared to the Graph Diffusion Convolution enhanced TextGCN, as evidenced by the higher accuracy rates across all datasets.