## 3 The Proposed Model
### 3.2. Ransomware Detection: Optimal GCNN Model  
To classify ransomware from legitimate activities, the GCNN model is used. The GCNN is a DL framework which works on graph-structured data. CNN is used to work on arbitrary graphs (with any number of edges and nodes, and graphs of some structure, cyclic or not) rather than on images [19]. Consider the image as a \"grid graph\" (all the nodes represent a pixel, and the pixel matrix of an image represents the adjacent matrix of grid graphs). To exploit the similar concept of filtering an image on the graph, rather than having a pixel that applies the data contained in its adjacent pixel to upgrade its value, it takes a node where it applies its adjacent node to upgrade its features. The GCNN classifies the edges or examines the existence of a connection between two nodes, classifies every node individually, or classifies the overall graph. To construct a GCNN, we begin to construct the adjacent matrix \(A\) of the graphs. For instance, non-oriented graphs consider \(A_{ij}=1\) (with \(A_{ij}\) being a component of the adjacent matrix \(A\)) when there is a connection between the \(i\)th and \(j\)th nodes, and \(A_{ij}=0\) if \(i\)th and \(j\)th nodes are mess linked. In addition, the node matrix \(H\) is constructed that contains stored information or a message in all the nodes, and later constructs the matrix \(H^{\prime}=\sigma(\hat{D}^{-1}\hat{A}HW)\), where \(W\) indicates a learnable node-wise shared linear conversion (linear layer in a DL architecture), \(\sigma\) denotes the non-linear function, for example, ReLU, \(\hat{A}=A+I\), where \(\hat{A}\) does not remove the central node, it forces a node to stay connected with itself, \(\hat{D}\) denotes the degree matrix, which provides the degree of all the nodes, \(\hat{D}\) is incorporated into the equation for normalizing \(A\) and enforcing the feature not to explode, while summing is named as the mean-pooling upgrade rule:  
\[H^{\prime}=\sigma\left(\hat{D}^{-\frac{1}{2}}\hat{A}\hat{D}^{-\frac{1}{2}}HW\right) \tag{8}\]The GCN update rule can be obtained using the above equation. Currently, this is the more commonly known graph convolution layer. Generally, nodes can transmit arbitrary messages alongside the edge \(\vec{e_{ij}}\) and then aggregate each message it receives through the permutable-invariant function, where \(\vec{n_{ij}}\) denotes the message transmitted from \(i\)th to \(j\)th nodes, evaluated by the message function \(f_{e}\):  
\[\vec{m_{ij}}=f_{e}\left(\vec{h_{i}},\vec{h_{j}},\vec{e_{ij}}\right), \tag{9}\]  
Then, each message which enters the nodes is aggregated through a readout function as follows:  
\[f_{b}:\vec{h_{i}^{\prime}}=f_{v}\left(\vec{h_{v}},\sum_{j\in N_{i}}\vec{m_{ji} }\right), \tag{10}\]  
In Equation (10), \(N_{i}\). represents the group of neighbors of \(i\)th nodes. This provides the message-passing neural network (MPNN), which applies only to smaller graphs. \(f_{e}\) and \(f_{t}\) are generally smaller multilayer perceptron and are generally expressed as follows:  
\[\vec{h_{i}^{\prime}}=\sigma\left(\sum_{j\in N_{i}}\alpha_{ij}\vec{w_{j}} \right), \tag{11}\]  
In Equation (11), \(\alpha_{ij}\) denotes the coefficient that is explicitly determined to cause certain deficiencies, or  
\[\alpha_{\bar{\mathrm{ij}}}=\frac{\exp\left(a_{ij}\right)}{\sum_{j\in N_{i}} \exp\left(a_{ik}\right)}, \tag{12}\]  
where  
\[a_{\bar{\mathrm{ij}}}=a\left(\vec{h_{v}},\vec{h_{j}},\vec{e_{ij}}\right), \tag{13}\]  
From the expression, \(a\) is a shared, learnable, self-attention model. It is named as the graph attention network upgrade rule. Briefly, the presented graph was encoded using three matrices: \(W,\ A,\ H,\) and \(D\). Using the aforementioned parameters, a matrix \(H^{\prime}\) can be evaluated after the selected update rule formula. The description of a GCNN is the process of encoding the graphs as matrix \(H^{\prime}\). At the final stage, the HSA is applied for the optimal hyperparameter selection process, a new intelligent optimized technique.