# A Novel Malware Detection Model in the Software Supply Chain Based on LSTM and SVMs
## 4 Proposed SSC Malware Detection Model
### The Construction of the BO-SVM Model  
This section details the BO-SVM model to detect malware in the SSC. The BO-SVM model uses the SVM model for detection as the SVM model is determined by a small number of support vectors and not by the dimensionality of the sample space. It has better robustness to outliers and noise. Afterwards, the BO algorithm is utilized to search the hyperparameters of the SVM model to determine the best model hyperparameters, so as to significantly improve the detection performance. Figure 2 displays the BO-SVM model flowchart.  
The establishment steps of the BO-SVM model are as follows:  
1. Input the malware dataset D: Select the malware dataset as the input. The dataset D is defined as a \(M*N\) matrix, where each line is denoted as \(\{id,f_{1},f_{2},\cdots,f_{i},\cdots,f_{n},c\}\), wherein \(id\) represents each line, \(f_{i}\) each feature, and \(c\) the label.
2. Data preprocessing D: The primary tasks of the preprocessing of the data in this research are to handle missing values and software feature outliers. After that, the data are standardized.
3. Split the malware dataset: The processed data are divided into a training set T1 and a test set S1.
4. Dimensionality reduction: Apply PCA to the training set T1 and the test set S1. The T1 is defined as a \(J*N\) matrix and the S1 is defined as a \(L*N\) matrix, wherein \(L=M-J\). The same parameters are used for the PCA algorithm to maintain the consistency of the data. Generate the training set T2 and test set S2 after dimension reduction. The T2 is defined as a \(J*K\) matrix, where each line is denoted as \(\{id,f_{1},f_{2},\cdots,f_{i},\cdots,f_{k},\ c\}\), wherein, \(k<n\). The test set S2 is defined as a \(L*K\) matrix.
5. Initialize the SVM model with the default hyperparameters \(\gamma\) and \(C\).
6. Generate the candidate solution space P: Generate the candidate solution space P for the hyperparameters \(\gamma\) and \(C\) by defining the parameter search range.
7. Update the P: Add new candidate solutions to the P after each iteration, and input all candidate solutions in the set into the GP regression model.
8. Perform GP regression calculation: The GP regression model shown in Equation (6) is used to calculate the function values and probability distributions for all candidate solutions. That is, the confidence of each candidate solution is obtained.
9. Generate new candidate solutions: A new candidate solution is generated using the EI sampling strategy shown in Equation (7). The EI sampling strategy uses the resulting confidence to determine the next candidate solution to evaluate.
10. Fit the SVM model: Use the new candidate solution as hyperparameters \(\gamma\) and \(C\) to fit the SVM model. Then, calculate the accuracy of the current SVM model.  
Figure 2: Flowchart of the BO-SVM model’s establishment.  
* Make a judgment: Determine whether the stopping criterion is reached (the optimized model accuracy or the number of iterations approach the threshold). If it is met, carry out step 12; otherwise, go back to step 7.
* Evaluate the BO-SVM model: First, select a candidate solution with the highest accuracy as the hyperparameters \(\gamma\) and \(C\). Then, test the trained BO-SVM model using the test set S2 to check if it meets the criteria (whether the accuracy is up to the required level). If it does, proceed to the next step; otherwise, go back to step 5 to retrain the model.
* Obtain the optimal SVM model: After the above steps, the optimized model BO-SVM is achieved.