# Ransomware Detection Model Based on Adaptive Graph Neural Network Learning +
## 2 Materials and Methods
### Graph Neural Network Correlation Method  
In the realm of graph neural networks (GNNs), a comprehensive review [29] offers profound insights into the understanding and effective application of GNNs to address practical problems. The graph convolutional network (GCN) introduces a graph convolution operation, capturing node relationships via an adjacency matrix and learning representations of adjacent nodes and its own nodes through a convolution operation. The seminal work of [PERSON] and [PERSON] (2016) [30] established the foundation for GCN, with their innovative ideas and methods significantly influencing subsequent GNN research. GCNs [30; 31] extend convolution operations to local graph structures, thereby offering impressive performance for various graph mining tasks [32; 33; 34]. The primary function of the graph convolution operation is to aggregate information from nodes directly adjacent to the central node, a process also known as message passing [35]. To propagate information between nodes at a greater distance, multiple neural layers can be stacked to exceed the direct jump of neighbors. To directly gather high-order information, spectral-based GNNs utilize graph spectral characteristics to collect signals from global neighbors [36; 34; 37].  
The TextGCN model [18] constructs a text graph in a corpus based on word co-occurrence and the relationship between words in the text, providing a novel approach to ransomware detection using TextGCN based on API call sequences. The inductive learning framework of GraphSAGE [32] effectively utilizes node attribute information to efficiently generate embeddings for previously unseen nodes. The Graph Attention Network (GAT) [33] introduces an attention mechanism, effectively utilizing node attribute information to efficiently generate embeddings for unknown nodes. Graph Diffusion Convolution [38] aggregates information not only from single-hop neighborhoods but also from larger neighborhoods, thereby capturing long-distance contextual information and better characterizing node features.  
The Adaptive Diffusion Convolution strategy [39] is a deep learning method specifically designed for GNNs, marking a significant innovation. It allows each GNN layer and each feature channel to have different neighborhood sizes and can automatically learn the optimal neighborhood size from the data, thereby enhancing the effectiveness and performance of graph convolution and improving the model's adaptability to different graph structures and feature dimensions. Adaptive Diffusion Convolution offers several advantages: (1) It can adaptively select the most suitable neighborhood size based on different graph structures and tasks, eliminating the need for manual adjustment or a grid search. (2) It can learn a dedicated neighborhood size for each GNN layer and feature channel, enabling the GNN to better couple with the graph structure and feature channels, thereby enhancing the model's expressive power. (3) It can be directly inserted into existing GNNs without altering the network's depth or width and without incurring significant computational costs.  
A key feature of Adaptive Diffusion Convolution is its ability to automatically learn the optimal neighborhood size from the data. This means it can determine how many neighbors should be considered based on the characteristics of each node and the requirements of the task, allowing Adaptive Diffusion Convolution to better capture the local and global structures of the graph. Adaptive Diffusion Convolution is a method that uses an adaptive diffusion kernel to diffuse images or feature maps. This method allows Adaptive Diffusion Convolutional to dynamically adjust the shape and size of its diffusion kernels based on the characteristics of the input data, ensuring that it meets the specific information aggregation needs of different ranges and scales. Consequently, we consider using Adaptive Diffusion Convolutional to address the co-occurrence information learning challenges in ransomware detection.