# A Novel Malware Detection Model in the Software Supply Chain Based on LSTM and SVMs
## 2 Related Work  
Some researchers have proposed detection methods based on ML algorithms. For example, [PERSON] et al. [9] proposed an ML-based model using data visualization and adversarial training to detect different types of malware and its variants. The model is applicable to most of the generic malware file formats. The model generates adversarial samples for simulating potential malware variants, which not only extends the malware dataset but also facilitates the extraction of malware features. In addition, the commonly used adversarial sample generation methods and image transformation methods have been optimized. [PERSON] et al. [10] analyzed the IoT 23 dataset with 1429,574 samples across \(11\) categories using Decision Tree (DT), Random Forest (RF), SVM, and Gaussian Naive Bayes (GNB). [PERSON] et al. [11] proposed a hybrid model which uses Logistic Regression(LR), DT, and K-Nearest Neighbor (KNN) for classification. The predictions of these three models are then aggregated to form new features. After that, the original and new features are combined to form a new feature set. Finally, the new feature set is used as input to train the RF model. Moreover, a large number of researchers have proposed DL-based detection methods. For instance, [PERSON] et al. [12] proposed a convolutional neural network (CNN) and LSTM model. This model detects advanced malware by automatically abstracting and expressing high-level n-gram API requests as sequential feature maps and without any feature engineering. [PERSON] et al. [13] proposed a model combining an LSTM network with a CNN. The researchers created two separate networks to train both. One is trained by classes.dex files and the other one collects so files and binary files that have been written in native libraries. [PERSON] et al. [14] proposed a malware detection system called MAPAS. The system first obtains the API call graph by conducting the taint analysis with Flowdroid. After that, deep learning of the dataset is performed using a CNN. After the learning phase finishes, MAPAS uses the deep learning interpretation approach, Grad-CAM, to discover high-weight API call graphs used in malicious applications. Finally, the Jaccard algorithm is used to calculate the similarity between the API call graphs of an application and the high-weighted API call graphs of malicious applications to classify the malware. [PERSON] et al. [15] proposed an improved DL-based DenseNet model to classify malware variants. The model improves the final classification layer of the DenseNet model using a reweighted class-balanced loss function. The binary files are then depicted as two-dimensional images and classified by the improved DenseNet model. [PERSON] et al. [16] proposed a malware detection method based on a VGG16 network. The method first uses the Cuckoo Sandbox to dynamically analyze the samples, converts the dynamic analysis results into visual images according to a designed algorithm, and trains the VGG16 network on static and hybrid visualization images. [PERSON] et al. [17] analyzed in depth the applicability of artificial neural networks in network intrusion detection and showed that although artificial neural networks and their DL models perform well in terms of performance, their training process is often slow and takes a long time to converge due to back propagation algorithms. [PERSON] et al. [18] proposed an optimization method for anomalous network traffic detection based on a Semi-Supervised Double Deep Q-Network (SSDDQN). In a SSDDQN, the current network first adopts the autoencoder to reconstruct the traffic features and then uses a deep neural network as a classifier. The target network first uses the unsupervised learning algorithm K-Means clustering and then uses deep neural network prediction. In addition, some other researchers have explored hybrid detection methods that combine DL with ML. For example, [PERSON] et al. [19] proposed a hybrid detection model.