# A Novel Malware Detection Model in the Software Supply Chain Based on LSTM and SVMs
## 3 Technical Overview
### Support Vector Machines  
The SVM is a prevalent model for binary classification problems [24; 25]. It is fundamentally a linear classifier that operates on the principle of maximum margin separation within the feature space, a characteristic that distinguishes it from the perceptron.  
The basic idea of SVM learning is to find separating hyperplanes that correctly delimit the training dataset with maximum geometric spacing. For the sample to be classified \((x_{i},y_{i})\), there is a hyperplane that completely separates the two classes of samples, and the hyperplane is shown in Equation (1).  
\[\omega\cdot x+b=0, \tag{1}\]  
Figure 1: Internal unit structure of the LSTM.  
where \(\omega\) is the normal vector that defines the direction of the hyperplane and \(b\) denotes the offset, which specifies the distance between the origin and the hyperplane.  
For data that are not linearly separable, solving a hyperplane can be understood as solving a quadratic programming problem as shown in Equation (2).  
\[min\frac{||\omega||^{2}}{2}+C\left(\sum_{i=1}^{N}\xi_{i}\right)\]  
\[s.t.y_{i}(x\cdot\omega+b)\geq 1-\xi_{i},i=1,2,\cdots,N, \tag{2}\]  
where \(C\) is the penalty factor, which controls the penalty degree for the correctly and incorrectly classified samples. Let \(\xi_{i}\) be the slack variable. The slack variable for each sample corresponds to its degree of non-satisfaction with the constraint.  
Solving Equation (2) can be transformed into finding its dual problem, as shown in Equation (3).  
\[maxW(\alpha)=\sum_{i=1}^{N}\alpha_{i}-\frac{1}{2}\sum_{i=1}^{N}\sum_{j=1}^{N} \alpha_{i}\alpha_{j}y_{i}y_{j}K\big{(}x_{i},x_{j}\big{)}\]  
\[s.t.\sum_{i=1}^{N}y_{i}\alpha_{i}=0,0\leq\alpha_{i}\leq C,i=1,2,\cdots N, \tag{3}\]  
where \(\alpha_{i}\), \(\alpha_{j}\) are the Lagrange multipliers, the vectors corresponding to \(\alpha_{i}>0\) are the support vectors, and \(K(x_{i},y_{i})\) is the kernel function. When the data input to the model are nonlinear, the kernel function needs to be introduced to map the samples to a high-dimensional space. Radial Basis Kernel (RBF) function, polynomial kernel function, and other frequently used kernel functions are among them. The choice of kernel function can significantly influence the algorithm's performance. In this paper, the RBF is used. Its expression is given in Equation (4).  
\[k\big{(}x_{i},x_{j}\big{)}=exp\Bigg{(}-\frac{\left\|x_{i}-x_{j}\right\|^{2}}{ 2\gamma^{2}}\Bigg{)}, \tag{4}\]  
where \(\gamma\) is the parameter of the kernel function.  
The optimal decision function is given in Equation (5).  
\[f(x)=sgn\left[\sum_{i=1}^{N}\alpha_{i}^{*}y_{i}K(x_{i},x)+b^{*}\right], \tag{5}\]  
where \(sgn(x)\) is a symbolic function that returns \(-1\) if \(x<0\); when \(x>0\), the return value is 1. When \(x=0\), it returns 0. Here, \(\alpha_{i}^{*}\) is the optimal Lagrange multiplier, and \(b^{*}\) is the optimal bias.  
Malware in the SSC often employs various disguises to evade detection by various security systems. This results in the malware in the SSC exhibiting more characteristics and an increase in its dimensionality. The SVM model is suitable for SSC malware detection since it is determined by a small number of support vectors rather than the dimensionality of the sample space.