# Ransomware Detection Model Based on Adaptive Graph Neural Network Learning +
## 3 Methodology
For the nodes \(v\in V_{T}\) of the text graph, construct a node weight measurement formula based on the set of sensitive API functions \(S\), and amplify features related to sensitive APIs. 5: Input the constructed text graph into the TextGCN network: Input the constructed text graph \(G_{T}\) into the TextGCN network \(G\), integrate the Adaptive Diffusion Convolution strategy, using the neighborhood radius formula to dynamically adjust the diffusion process: \[r=\frac{\sum_{s=0}^{\infty}\beta_{s}s}{\sum_{s=0}^{\infty}\beta_{s}}\]

where \(\beta_{s}\) represents the influence received from nodes at an s-step distance, allowing the model to adjust its information propagation range based on the node's connectivity density and structural information. 6: Use the classifier model to classify the output: Use a classifier model to classify the output of the ADC-TextGCN network \(G\) and generate results. ### Extract API Call Sequences and Sensitive Functions

In the field of ransomware detection, the extraction of API call sequences is a key step, and there are mainly two methods: static analysis and dynamic analysis. The extraction of API call sequences involves obtaining the names and order of APIs called by a program from its code or execution process, which can reflect the program's functionality and behavior, making it suitable for program analysis tasks such as malware detection, code cloning detection, and code search. The static analysis method extracts API call sequences without executing the program. It analyzes program code from the perspectives of vocabulary, grammar, and semantics. Figure 3: Schematic of the ADC-TextGCN. Nodes starting with ‘O’ are document nodes, while others are word nodes. Black bold edges represent document-word connections, and gray thin edges represent word-word connections. R(x) denotes the representation (embedding) of x. Different colors signify different document categories. The circles on the right-hand side of the figure illustrate the neighborhood radius used to capture and represent node information, with multiple circles emphasizing the concept of adaptability. However, due to the inability to handle dynamically loaded APIs or parse complex control and data flows, it may generate false positives or false negatives. The dynamic analysis method extracts API call sequences by monitoring, recording, and analyzing the execution process of the program. The dynamic analysis method can accurately obtain the API actually called by the program, without being affected by the code structure, and can handle dynamically loaded APIs. However, it can only cover a portion of program branches and paths and is influenced by input data. We tracks the execution process of the program and obtains the API call sequence by running the example executable file in the Cuckoo Sandbox, as shown in Figure 4. In addition, sandbox technology can be used for online virus analysis and malware behavior detection [40]. Based on the API-service set, we propose a hybrid API weight evaluation method and map it to graph nodes. We regard sensitive API call functions as sensitive nodes. If node i is a sensitive node, then the weight between node i and its neighbor node j will be increased. This means that the original weight between i and j is multiplied by \(\alpha\), which is a weight growth factor. If both nodes i and j are not sensitive, the original weight between nodes i and j is retained. The value of \(\alpha\) is determined by a matrix search. An example is shown in Figure 5, where the dark-red nodes represent sensitive API call functions, i.e., sensitive nodes. In addition, the light-blue nodes represent general API call functions. The left figure is the original call sequence text graph. Since node 3 is a neighbor node of the sensitive node, the weight between nodes 2 and 3 should be multiplied by the weight growth factor \(\alpha\). However, node 4 is not directly connected to node 2, so A1-4 remains unchanged. Node 2 is a sensitive API call function, and nodes 3, 4, and 1 are not sensitive.