# Ransomware Detection Model Based on Adaptive Graph Neural Network Learning +
## 3 Methodology
The calculation formula for _IDF_ is

\[IDF_{i}=log\frac{|D|}{1+\left|j:t_{i}ed_{j}\right|}\]

where the denominator is increased by 1 to avoid the situation where the denominator is zero, \(|D|\) represents the total number of all documents, and \(\left|j:t_{i}ed_{j}\right|\) represents the number of documents containing term \(t_{i}\). Finally, the calculation formula for TF-IDF is

\[TF\_IDF=TF\_IDF\]In this way, TF-IDF tends to filter out common words and retain important words, effectively calculating the weight between document nodes and word nodes. Multiplying TF and IDF can obtain the importance weight of a word in a document. Common weighting methods include TF \(\times\) IDF, log(TF + 1) \(\times\) IDF, etc. It is a statistical method used to evaluate the importance of a word to a document. The importance of a word increases in direct proportion to the number of times it appears in a document, but at the same time, its importance decreases inversely with the frequency it appears in the corpus. To utilize global word co-occurrence information, we use a fixed-size sliding window on all documents in the API call function to collect global word co-occurrence information and word order information. By adopting the COIR-PMI theory of co-occurrence information retention, changing the co-occurrence rules of PMI, and obtaining word order information, the weight between two word nodes can be calculated. While building the API call sequence text graph, numerous API functions are invoked. A sliding window of size N scans each executable file's API call sequence, forming an N-length fragment. For instance, consider an executable program that sequentially calls 12 functions, as demonstrated in Figure 2:0

The fragment for this API call function when N = 5 is shown in Figure 2:1 \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**API Call Function Name** & **Thread Number** & **Sequence Number** & **Function Type** & **Risk Factor** \\ \hline InternetOpenA & 2332 & 47 & Network & Low \\ InternetOpenLUHA & 2332 & 48 & Network & Low \\ OpenSCManagerA & 2332 & 33 & System & High \\ CreateServiceA & 2332 & 49 & System & High \\ StartServiceA & 2332 & 50 & System & High \\ LdrGetProcedureAddress & 2332 & 51 & Loader & Medium \\ NtQueryDirectoryFile & 2332 & 52 & File System & Medium \\ NtRequiresWaitReplyPort & 2332 & 37 & Port & Low \\ NicCreateFile & 2332 & 54 & File System & Medium \\ NtQuery & 2332 & 56 & System & High \\ NtQueryValueKey & 2332 & 42 & Registry & High \\ NtConnectPort & 2332 & 58 & Port & Low \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Example of API call function. Figure 6: The fragment for the API call function. The green rectangular box represents the sliding window which moves across the API call sequence. Light blue nodes within the window indicate selected API call sequences (Sequence Number), and grey nodes represent those not selected. In the COIR-PMI method, we have modified the PMI statistical rule to compute the weight of the edge between two word nodes. This algorithm uses PMI to measure the correlation between two variables, preserving both word order and co-occurrence information. We employ a sliding-window approach to extract valid sequence relationships for API call functions. The TF-IDF algorithm is utilized to retain API call interfaces that are pertinent to classification. Calculating COIR-PMI: The _PMI_ value for word pair \(i,j\) is computed as follows:

\[COIR-PMI(\text{i},j)=log\frac{p(\text{i},j)}{p(\text{i})p(j)}\]

\[p_{(i,j)}=\frac{\#W(i,j)}{\#W}\]

\[p_{(i)}=\frac{\#W(i)}{\#W}\]

In these equations, \(\#W(i)\) represents the count of sliding windows in a corpus that contains word \(i\), \(\#W(i,j)\) is the count of sliding windows that contain words \(i\) and \(j\) in order, and \(\#W\) is the total count of sliding windows in the API call sequences. For instance, consider the calculation of co-occurrence of 47 and 48 in Table 1. The count of co-occurrences of 47 and 48 in the window {(47,48,33,49,50)} is 1, but the count in the window {(48,47,33,49,50)} is 0.