Real-Time Ransomware Detection Method Based on TextGCN

Ransomware detection methods are essential for safeguarding cybersecurity and user privacy. Current detection methods based on CNN and RNN prioritize order and local information, which can be easily captured in continuous word sequences, but these methods ignore global word co-occurrence. Global word co-occurrence, which carries discontinuous information and long-distance semantic information, is critical for ransomware identification. To solve this problem, in this paper, we propose a novel ransomware detection method based on the Text Graph Convolution Network (TextGCN). In TextGCN, weights of the word nodes are adjusted based on the sensitive API call functions, which are summarized according to the five critical steps in the execution of ransomware. We also proposed a co-occurrence information retaining pointwise mutual information theory (COIR-PMI) to calculate weights of word nodes in order to retain both order and co-occurrence information. Experimental results show that the efficiency of our optimized novel approach achieves more than 96.6% ransomware detection accuracy.