Ransomware Detection

GCN · internal_only

Standard SplitFeb 17, 2026

8137724c215e436080a432fb2d39fc8f

Description

Train GCN on the internal_only dataset to compare GNN architectures. Same hyperparameters and data split as GIN experiments.

Conclusion

GCN performs well (96.3% accuracy) but below GIN (98.2%). Recall drops to 93.8% — GCN misses some malware samples. GIN remains the stronger architecture on this dataset.

Test Metrics

Accuracy

96.3%

F1 Macro

95.6%

F1 Malware

93.8%

Precision

93.8%

Recall

93.8%

AUROC

98.4%

Best Val Loss

0.1720

Training Time

1057.2000s

Confusion Matrix

Pred BenignPred Malware
Actual Benign742
Actual Malware230

Configuration

Hidden Dim128
Num Layers3
Dropout0.5
Batch Size4
Learning Rate0.001
Weight Decay0.0001
Max Epochs200
ES Patience20
ES Min Epochs100
LR Patience10
LR Factor0.5
Mixed PrecisionYes
Random Seed42
Epochs Trained108