# Ransomware Detection Model Based on Adaptive Graph Neural Network Learning +
## 1 Introduction  
Ransomware is a type of malicious software that encrypts or locks users' files or systems to obtain their private information and demands a high ransom from the users. If the ransom is not paid in time, the ransomware may leak the user's private information. Modern ransomware emerged around 2005 and quickly became a viable business strategy for attackers [1, 2]. A notorious example of ransomware is WannaCry, which quickly spread across many computer networks in May 2017 [3, 4]. Within a few days, it infected over 200,000 computers in 150 countries [5]. In recent years, ransomware has been growing exponentially, expanding its reach across different platforms, and continuously evolving. This escalation has made ransomware detection crucial not only for protecting individuals' private information but also for improving the overall governance of cyberspace security, thereby making it a primary focus in current information security risk detection research [6, 7]. Ransomware can be classified into three main types: crypto, locker, and scareware [8; 9], as shown in Figure 1. Crypto ransomware extorts users by encrypting important files stored on their hard drives, making them inaccessible unless a ransom is paid to obtain the decryption key. Locker ransomware locks down the entire operating system, preventing users from accessing their desktop or any personal files and demands a fine to unlock the computer. Unlike crypto ransomware, it usually does not encrypt files but severely limits access to the computer. Scareware falsely informs users that their system has security issues or needs to clean up junk files, often using pop-up windows or warnings to intimidate users into paying for the \"full version\" of the software to fix these non-existent problems. The evolution of ransomware often involves hackers modifying existing codes to develop new variants, which, while differing in code structure, share similar behavioral goals. According to recent studies, over 98% of ransomware stems from established families, often incorporating or adapting functions from their predecessors [10]. Hackers might also intersperse normal behaviors within the ransomware code to evade detection [11]. The most commonly used ransomware detection methods are static detection and dynamic detection [12]. Static detection focuses on feature extraction and matching of malicious programs in binary form in non-running states. Dynamic detection builds a simulated running environment for specified ransomware samples and records ransomware behavior. Despite their extensive use, these technologies suffer from high rates of false positives and false negatives [13], primarily because they fail to recognize patterns involving non-continuous global word co-occurrences--critical for identifying ransomware. Recent advancements underscore the importance of innovative technologies in combating the evolving threats posed by ransomware. [PERSON] et al. [14] investigated the use of machine learning and graph neural networks in network security, conducting an in-depth analysis of these technologies in intrusion, malware, and spam detection. This research evaluated the current effectiveness and maturity of these solutions, which are crucial in addressing ransomware's rapid evolution and complex evasion tactics. Especially, graph neural networks have become a powerful tool for text representation learning, significantly enhancing the understanding of semantic relationships in malicious software code [15]. However, while CNN [16] and RNN [17] are adept at extracting features from continuous word sequences, they often overlook global word co-occurrence and the associations between key node steps. Global word co-occurrence information refers to the relationship between words that appear discontinuously in the text. They carry long-distance semantic information, which is crucial for ransomware recognition.