# Ransomware Detection Model Based on Adaptive Graph Neural Network Learning +
## 3 Methodology
The weight between nodes 2 and 3 is multiplied by \(\alpha\), but the weight between nodes 1 and 4 is still A14. Figure 4: Dynamic extraction process of the API call sequence. Figure 5: Sensitive API call functions adjust the weights of word nodes. (**a**) Before using sensitive API call function adjustment, with light-blue nodes representing general API call functions and dark-red nodes indicating sensitive API call functions. (**b**) after using sensitive API call function adjustment. Building on this foundation, to understand the relationship between non-adjacent API calls in the sequence, we introduce the Adaptive Diffusion Convolution mechanism. This mechanism evolves from Graph Diffusion Convolution, which uses the manual adjustment of the neighborhood size for feature aggregation into an adaptive learning size. Adaptive Diffusion Convolution can automatically learn the neighborhood radius of each graph neural network (GNN) layer and each feature dimension. Its adaptive mechanism allows each node to have a neighborhood radius suitable for itself, which can be integrated into the learning process of the co-occurrence information of ransomware. For a sensitive node with a larger weight, a node that is highly similar to it and has co-occurrence information may not be its neighbor node. The Adaptive Diffusion Convolution method can adaptively adjust the neighborhood radius of the node to the optimal situation, and the neighborhood radius will include that node. By aggregating more node co-occurrence information, the center point can be better enriched, potentially leading to improved learning results. ### Constructing Graph Network by Combining API Sequences

A graph is constructed from the API call sequence text, incorporating word nodes, document nodes, and weighted edges. This structure aims to preserve as much word order information and co-occurrence information as possible. The total number of nodes \(|\)V\(|\) in the text graph is the aggregate of two types of documents (ransomware and benign documents) and the count of unique API call functions. The API call sequence text graph, as implemented in ADC-TextGCN, is a large heterogeneous text graph, thereby enabling it to explicitly model valuable feature information. Within the API call sequence text graph, API call functions serve as word nodes, while ransomware and benign software are represented as document nodes. The edges between nodes are established based on the occurrence of words within the document and the co-occurrence of words within the API call sequence. Term Frequency-Inverse Document Frequency (TF-IDF) is a widely used weighting technique in information retrieval and data mining, which assesses a word's relevance to a document within a corpus. TF-IDF consists of two parts: _TF_ and _IDF_. _TF_ (Term Frequency): This represents the frequency of a term in a text. This number is usually normalized (generally, the Term Frequency divided by the total number of words in the article) to prevent it from favoring longer documents (the same word may have a higher Term Frequency in a long document than in a short document, regardless of the importance of the word). The calculation formula for _TF_ is

\[TF_{i,j}=\frac{n_{i,j}}{\Sigma_{k}n_{k,j}}\]

where \(n_{i,j}\) denotes the number of occurrences of term \(t_{i}\) in document d\({}_{j}\), and \(TF_{i,j}\) represents the frequency of term \(t_{i}\) in document d\({}_{j}\). Inverse Document Frequency (_IDF_): This metric represents the general significance of a keyword. If fewer documents contain the term, the _IDF_ will be larger, indicating that the term has good category differentiation ability. The _IDF_ of a specific word can be obtained by dividing the total number of documents by the number of documents containing the word, and then taking the logarithm of the quotient.