# Ransomware Detection Model Based on Adaptive Graph Neural Network Learning +
## 3 Methodology
The heat kernel incorporates prior knowledge into the TextGCN model, implying that the feature propagation between nodes adheres to [PERSON]'s cooling law [44], i.e., the speed of feature propagation between two nodes is proportional to the difference in their features. Here, \(t\) can be interpreted as the diffusion time of node \(i\). Upon substituting the heat kernel formula into the generalized neighborhood radius Formula (9), and following a mathematical derivation involving exponential series, it can be deduced that the neighborhood radius \(r\) perfectly corresponds to the diffusion time \(t\). \[r_{h}=\frac{\sum_{s=0}^{\infty}\beta_{s}s}{\sum_{s=0}^{\infty}\beta_{s}}= \frac{\sum_{s=0}^{\infty}\mathrm{e}^{-t}\frac{t^{\prime}s}{s!}}{\sum_{s=0}^{ \infty}\beta_{s}}=\frac{\mathrm{e}^{-t}\frac{t^{\prime}s}{s!}}{\sum_{s=0}^{ \infty}\mathrm{e}^{-t}\frac{t^{\prime}}{s!}}=\frac{\mathrm{e}^{-t}\big{(} \mathrm{e}^{t}t\big{)}}{\mathrm{e}^{-t}\mathrm{e}^{-t}\mathrm{e}^{t}}=t\]

This demonstrates that t, based on the heat kernel, is the neighborhood radius, implying that t becomes the perfect continuous substitute for the number of hops in the multi-hop model. This strategy provides a unique neighborhood size for each layer and channel, achieving more detailed adjustments and circumventing the need for manual adjustments. ## 4 Results

This section first presents the dataset employed in the experiment. Subsequently, we delve into a thorough analysis of the detailed steps involved in the implementation process, followed by a comprehensive evaluation of the experimental performance. Ultimately, we utilize these data for training and testing purposes to derive the experimental outcomes. Our code and dataset details can be found at www.sogithub.com/Yangggy/ABC (accessed on 18 March 2024). ### Datasets

Our study utilized a comprehensive dataset consisting of 3000 ransomware samples and 2000 benign software samples carefully selected from reputable sources such as VirusShare, VirusTotal, and other well-known repositories. This selection aims to capture a wide range of ransomware behaviors and benign software patterns, ensuring the diversity and representativeness of our dataset. In addition to our main dataset, we integrated data from the Ember dataset, malware_api_class dataset, and UNSW-NB15 dataset. These sources were integrated to expose our model to a wider range of malware features, behaviors, and attack types, including those that are not strictly classified as ransomware, thereby enhancing the robustness and accuracy of our detection model. We used a Cuckoo Sandbox for the dynamic analysis of each sample, which enables us to capture the detailed execution of API call sequences. This analysis provides a rich feature set for distinguishing ransomware from benign software. We extracted relevant features from the API call sequence, with a focus on those features that have the highest frequency and significance in representing ransomware activities. Irrelevant information, including common stop words and uninformed API calls, was removed to increase the model's focus on important patterns. All features have been normalized to ensure scale consistency, thereby promoting more effective learning. To address the potential imbalance between ransomware and benign software samples and enhance the model's generalization ability, we adopted the Synthetic Minority Oversampling Technique (SMOTE). This technique generates composite ransomware samples by interpolating existing ones, enriching the diversity of ransomware behavior in our training set. When evaluating model performance, we focus on key indicators such as accuracy, precision, and recall to ensure that our research results can effectively identify ransomware and provide powerful tools for professionals in the field of network security.