# Ransomware Detection Model Based on Adaptive Graph Neural Network Learning +
## 3 Methodology
In the specific context of ransomware sample detection, the AUC serves as a comprehensive metric of the model's detection capability, while accuracy validates the model's ability to correctly identify both benign software and ransomware samples. For this experiment, we selected TPR, FPR, AUC, and accuracy (ACC) as our evaluation metrics. A larger AUC value signifies a more effective classifier. The ROC is a two-dimensional curve, with FPR and TPR serving as its horizontal and vertical coordinates, respectively. Within the confusion matrix, positive refers to a ransomware sample, while negative refers to a benign software sample. True positive indicates that the predicted result aligns with the actual situation, whereas false positive indicates a discrepancy between the prediction (ransomware) and the actual situation (benign software). Table 3 provides an overview of the advantages and disadvantages of each model, including ADC-TextGCN, which provides a detailed perspective on its relationship with other methods from the perspectives of effectiveness, complexity, and application scope. This comparison table emphasizes the advanced capabilities of the ADC-TextGCN model to synthesize and learn extensive and complex ransomware data, which is attributed to its adaptive diffusion strategy. However, it also emphasizes the necessity for substantial computing power and the complex model optimization process, which may pose challenges in certain environments. In contrast, while other models, such as CNNs and LSTM, offer valuable advantages, such as ease of implementation and effectiveness in processing sequential data, they all have limitations that ADC-TextGCN aims to overcome, especially in dealing with long-term dependencies and global context understanding. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Parameters** & **Momentum** & **Weight Decay** & **Epoch** & **Batch Size** & **Initial Learning Rate** \\ \hline Our model & 0.937 & 0.0005 & 300 & 32 & 0.01 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The parameters used in our model and their respective values. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Model/Approach** & **Advantages** & **Disadvantages** \\ \hline \multirow{3}{*}{ADC-TextGCN} & High accuracy and precision; effective & \multirow{3}{*}{\begin{tabular}{c} Requires significant computational resources \\ for training; complexity in tuning for optimal \\ neighborhood size. \\ \end{tabular} } \\  & & & \\ \cline{1-1}  & & & \\ \cline{1-1}  & & & \\ \hline CNN-based model & Excellent at capturing local and spatial & \multirow{3}{*}{\
\begin{tabular}{c} Struggles with long-range dependencies; less \\ effective in capturing global context. \\ \end{tabular} } \\  & dependencies; relatively simple to implement. & & \\ \hline LSTM-based approach & Good at processing sequential data and & \multirow{3}{*}{
\begin{tabular}{c} Prone to vanishing gradient problem; \\ computational inefficiency with long sequences. \\ \end{tabular} } \\  & capturing long-term dependencies. & & \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Comparative analysis of ransomware detection models. ### COIR-PMI Experiment and a Factor Experiment

The co-occurrence retention algorithm, leveraging the COIR-PMI theory delineated in Section 3.2, was examined. Table 4 showcases the accuracy attained by various statistical methods when N equals 7. The table illustrates that the accuracy is enhanced when the weight between two word nodes is calculated using the COIR-PMI theory to preserve co-occurrence information. This approach bolsters the precision of the classification during training. The letters in parentheses represent the first letter of the dataset, where E represents the Ember dataset, M represents the malware_api_class dataset, and U represents the UNSW-NB15 dataset. As the following table is identical to the previously discussed content; hence, a detailed explanation is not provided. We investigated the influence of the \(\alpha\) factor on the comprehensive performance of ADC-TextGCN.