Abstract: A system, computer program product, and method are provided to graph neural network (GNN) ensemble learning. Training data is represented in a graph format, from which two or more subgraphs are sampled. Two or more GNNs are training from feature space sampled from the subgraphs. The GNN ensemble is built from the trained GNNs, and subject to testing data. Application of the testing data to the GNN ensemble generates output in the form of an ensemble value, with the output configured to interface with and selectively control an operatively coupled physical hardware device or software.

Abstract: A processor can be configured to receive data associated with, and/or access to, a computing system's file system structure. The processor can also be configured to determine file patterns, file path patterns and/or graph patterns associated with the computing system. The processor can also be configured to build a graph structure having nodes and edges, the graph structure representing the file patterns, file path patterns and graph patterns, wherein the nodes of the graph structure represent files and attributes of the files and the edges of the graph structure represent connectivity between the files. The processor can also be configured to train, based on the graph structure, a first machine learning model to learn a feature vector associated with a file. The processor can also be configured to train, based on the feature vector, a second machine learning model to identify a vulnerable ransomware target.