# Challenges of Malware Detection in the IoT and a Review of Artificial Immune System Approaches
## 4 AIS to Secure the IoT: Literature Review and Analysis
### AIS in Malware Detection in the IoT
#### 4.1.1 Negative and Positive Algorithms  
One of the objectives of the main concept of negative selection is to produce enough detectors to cover the non-self-area, and most approaches generate these detectors randomly in different ways in an attempt to cover holes and overlaps and improve the detection rate. To overcome this challenge, many researchers have proposed combining two different AIS methods. The authors in [50] proposed using negative and positive detectors for malware detection. The main goal of the proposed method (the NPS) is to use fewer detectors while achieving high detection and recall rates, making it suitable to meet the constraints associated with IoT devices. One of the shortcomings of this method is that it has not been validated in an actual implementation. Furthermore, the authors in [51] proposed the MNSA algorithm, which is a combination of negative selection and positive selection detectors. The first set of detectors can recognize self-data, and the other set of detectors is used to detect non-self-data. The combination of the results of these two detector sets is supposed to improve the detection rate for unknown malware files in the system. To test the method's efficiency, randomly generated 12-bit long strings are used for both training and detecting stages of the algorithm. As result, it was claimed in [51] that the MNSA algorithm can detect up to 34% of all intrusions without any prior knowledge about the non-self, and it can confirm more than 90% of those detected files. The main limitation of this research is the fact that it was tested on random strings and not actual malware files. Furthermore, this method uses too many detectors in both negative and positive sets.  
The authors in [37] proposed using the positive selection algorithm (PCSA) for malware detection. They define the PCSA as a general classification algorithm used for unknown data classification. Positive selection and clonal selection algorithm techniques were applied to secure the IoT. The algorithm has different stages, starting with the learning stage to produce classifiers: self and non-self. The main goal of this algorithm is to recognize self-data, and after the learning stage, the authors claim that all classifiers are available to classify unknown data. They also define two states after classification: overlap, where the unknown data is recognized by more than two kinds of classifiers; and hole, where the unknown data cannot be recognized by any classifier. To evaluate the proposed algorithm, the researchers in [37] compared their solution to another algorithm in [52]. In total, 3721 Windows malicious executables and 3458 benign Windows executables were collected for the experiment. There are four types of malicious files: backdoor, spywane, trojans, and worms. The main feature captured and used for malware detection here is I/O request packets (IRPs), for which they developed an MBMAS tool presented in [53] that can associate a process with its child process in run time. Researchers claimed a 99.30% accuracy result for the PSCA algorithm that they developed. The only limitation that this paper claimed is that IRP traces of programs vary from one host to another, and some IRPs repeat sometimes. This method has not been implemented in an IoT system, and we find this work not to be sufficiently robust to cope with the interconnective environment of the IoT.