# Ransomware Detection Model Based on Adaptive Graph Neural Network Learning +
## 3 Methodology
Therefore, \(\#W(i,j)\) is not equal to \(\#W(j,i)\). \[A_{ij}=\left\{ \begin{array}{c}COIR-PMI(i,j)\qquad\quad(i,j\;are\;words)\\ TF-IDF_{ij}\;\;(i\;is\;document,j\;is\;word)\\ 1\qquad\qquad\qquad\qquad\qquad\qquad\qquad(i=j)\\ A_{ij}\cdot\alpha\quad(i\;or\;j\;is\;sensitive\;API\;call)\end{array} \right.\]

Whether COIR-PMI is positive or negative carries practical significance and represents characteristic information. To retain more comprehensive information, we add edges between word pairs with _PMI_ values. After constructing the text graph, we feed the graph into a simple two-layer GCN. The second layer node (word/document) embeddings have the same size as the label set and are fed into a softmax classifier:

\[Z=softmax\big{(}\tilde{A}ReLU\big{(}\tilde{A}XW_{0}\big{)}W_{1}\big{)}\]

where \(\tilde{A}=\text{D}^{-\frac{1}{2}}\text{AD}^{-\frac{1}{2}}\), and \(softmax(x_{\text{i}})=\frac{1}{Z}exp(x_{i})\), with \(Z=\sum_{i}exp(x_{i})\). ### Adaptive Diffusion Convolution of ADC-TextGCN

The Graph Diffusion Convolution extends the discrete information propagation process inherent in the TextGCN to a diffusion process, thereby enabling the aggregation of information from larger neighborhoods. For each input graph, graph diffusion convolution manually fine-tunes the optimal neighborhood size for feature aggregation by conducting a parameter grid search on the validation set. However, this approach exhibits certain limitations and sensitivities in real-world applications. To obviate the need for a manual search for the optimal propagation neighborhood in Graph Diffusion Convolution, the Adaptive Diffusion Convolution strategy was introduced in TextGCN. This strategy supports the automatic learning of the optimal neighborhood from the data. During the message-passing process in each graph, all GCN layers and feature channels (dimensions) share the same neighborhood size. This strategy empowers GCNs to adapt more flexibly to various graph structures, thereby enhancing the model's generalization capability and performance. The neighborhood radius can serve as a metric for quantifying the propagation distance of features across each layer. The neighborhood radius \(r\) is calculated as:

\[r=\frac{\sum_{s=0}^{\infty}\beta_{s}s}{\sum_{s=0}^{\infty}\beta_{s}}\]

where \(\beta_{s}\) denotes the influence of nodes at a s-step distance. A large \(r\) signifies that the model places a greater emphasis on distant nodes, thereby accentuating global information. Conversely, a small \(r\) indicates a focus on local information. For graph convolutional networks (GCNs), when the neighborhood radius r equals 1, it only encompasses the range directly connected to the node. To access information beyond the direct connection range, it becomes necessary to stack multiple GCN layers to probe the high-order neighborhood. Models such as MixHop [41], JKNet [42], and SGC [43] strive to enhance the feature propagation function of the GCN by transitioning from a single-hop neighborhood to a multi-hop neighborhood. However, for all multi-hop models, the discrete nature of the number of hops renders the neighborhood radius r non-differentiable. This characteristic makes it improbable for r to adaptively participate in the Back-Propagation (BP) algorithm as a parameter. Consequently, the primary challenge in implementing the adaptive learning of the neighborhood radius lies in the non-differentiability of the radius. Specially, we introduce Adaptive Diffusion Convolution into the construction process of the API call sequence TextGCN to capture the features of high-order text information more effectively. By employing this strategy to automatically learn the optimal neighborhood size strategy from the data, the TextGCN is fully integrated with the graph structure and all feature channels. The emphasis is placed on the weight coefficients generated by the heat kernel version, denoted by \(\beta_{s}=-t\frac{t}{s}\).