# A Novel Malware Detection Model in the Software Supply Chain Based on LSTM and SVMs
## 1 Introduction  
With the quick advancement of smart technology, software has penetrated into every corner of modern society and become a basic element supporting the operation of society. Meanwhile, concurrent software security issues have gradually evolved into a focus of society. The field of software development has undergone significant changes in recent years. The traditional model, characterized by a single organization or supplier developing an individual product, has evolved into a collaborative approach involving the use of shared components. This new paradigm involves the use of shared components, which has given rise to the formation of a linear Software Supply Chain (SSC) [1]. An SSC refers to all links and processes involved in software development and delivery [2]. As the software industry experiences robust growth, SSC architecture is increasingly diversifying and becoming more intricate. Concurrently, SSC security challenges are escalating, posing formidable challenges to the robust security safeguards essential for software systems. Ensuring SSC security is paramount, as it is crucial for maintaining the integrity and safety of software throughout its entire life cycle. SSC security is not merely vital to the interests of developers, vendors, and enterprises; it is also essential for safeguarding the welfare of end-users and nurturing the health of the entire software ecosystem. Therefore, an in-depth examination of the SSC holds profound significance in order to uncover latent security threats. In recent years, SSC security incidents have occurred frequently, and the scope of their influence is constantly expanding [3]. According to a report released by Sonicwall, there were 5.5 billion malware attacks worldwide in 2022, representing a 2% increase compared to 2021 [4]. In this context, it is critical to effectively and accurately identify malware inthe SSC to prevent illegal attacks and unauthorized access. Traditional single-feature malware detection methods, especially signature-based techniques, are effective in identifying known malware. However, there are some shortcomings in these methods; malware makes it difficult for single-feature-based detection methods to effectively identify its true intent by changing its code structure and behavioral patterns [5]. Therefore, researchers have been turning to the development and validation of multi-feature methods, including methods based on malware behavioral analysis [6]. The introduction of emerging methods has led to the widespread use of machine learning (ML) algorithms for malware identification. Recently, some more advanced detection techniques have been proposed by the research community, such as hybrid SSC malware detection methods utilizing ML, deep learning (DL), and combining DL with ML [7]. [PERSON] et al. [5] illustrate that ML methods yield better results when detecting both known and some unknown malware. For complex malware that is not yet widely recognized, DL-based and hybrid detection methods demonstrate higher efficacy. In addition, another issue facing current research is how to maintain the high-accuracy detection performance of models within the constraints of computational resources and time. To effectively address these challenges, this paper proposes a novel detection model, i.e., the Bayesian-Optimized Support Vector Machine (BO-SVM). This model exploits an SVM to identify malware in the SSC, and calls the BO algorithm to optimize the SVM hyperparameters. Furthermore, this paper proposes a enhanced detection model that combines the Long Short-Term Memory network (LSTM) [8] with BO-SVM, referred to as the LSTM-BO-SVM model. Taking a set of static software features as the input, the LSTM network is firstly employed for software pre-classification to effectively capture the temporal association between features. Then, the BO algorithm is introduced to optimize the hyperparameters in the SVM model. Finally, the optimized BO-SVM model is achieved to complete malware detection in the SSC.