# Challenges of Malware Detection in the IoT and a Review of Artificial Immune System Approaches
## 2 Security Challenges and Malware Attacks in the IoT
### Malware Analysis and Detection
#### 2.2.2 Malware Detection Techniques  
Based on the analysis results described in the previous section, we present detection techniques that are designed to detect malware attacks effectively. Three main methods are used in malware detection: the signature-based detection technique, behavior-based detection technique, and specification-based detection technique (see Figure 3).  
* In the signature-based technique, files are analyzed and compared to an existing list, and if they are listed in the list, they are classified as malware. This method is not effective for recognizing all malware that enters the network because some malware is encrypted, and thus extracting the signature takes time and a large amount of processing energy. Furthermore, it is not effective for new or unknown malware.
* The behavioral-based method monitors the program's behavior rather than reading its signature. This technique follows three steps: the first step collects information about the program, the second step interprets the data through conversion to intermediate representations, and the last step matches the intermediate representation with known behavior signatures. There are two approaches to this technique, the first of which is simulating the behavior of legitimate programs and comparing any new program to that model. This approach works for the detection of most malware, even new kinds. However, it is expensive to implement because of the different behaviors of each program in the network; for example, a video reader will use different services than a mail or a web client. The second approach is simulating the behavior of known malware and comparing it to new programs, which means new (unknown) malware cannot be identified.
* The specification-based method was introduced to overcome the disadvantages and limitations of the first two techniques. This technique uses different features for malware detection, including the following: 1. API calls: [PERSON] et al. were among the first to propose using application interface and system call sequences for malware detection [22]. 2. OpCode: Executable files are made of series of assembly codes, and in this method, researchers use this operational code to detect malware [23]. 3. N-Grams: this method uses executable programs' binary codes for malware detection [24]. 4. CFG: This is a graph that illustrates the control flow of programs, and it has been used to analyze malware behavior [25]. 5. Hybrid feature: in this machine learning method, researchers combine different techniques for malware detection to get better results. For example, [PERSON] et al. in [26] used CFG and API calls for metamorphic malware detection. 6. Game theoretic-based anomaly detection algorithms: [PERSON], [PERSON], and [PERSON] presented different solutions to malware detection using behavioral analysis, such as the data exfiltration detection and prevention and consensus algorithm, with censored data for distributed detection [27]. 7. Prospect theoretic approaches: These approaches are based on measuring the trustworthiness of the aggregated data in the system. In [28], the authors present a hardware trojan detection game based on prospective theory approaches. Furthermore, in [29], the authors introduce a prospect theory-based framework to ensure risk awareness and protect network operations.  
The main limitation of the specification-based method is the difficulty to specify the whole set of legitimate behaviors that a system should exhibit accurately [30].