# Challenges of Malware Detection in the IoT and a Review of Artificial Immune System Approaches
## 3 Artificial Immune Systems
### Artificial Immune Systems Methods  
Based on the knowledge of how the adaptive immune system works, to defend the human body, researchers have started to develop different methods that imitate a similar process to protect computer networks. The use of AIS in security applications is mostly in the detection of security incidences, such as intrusions at the host or the network carried out by malicious actors, using low-level scripts, automated tools, or malware. We identify four artificial immune system methods: negative selection, positive selection, clonal, and artificial immune networks. The negative selection method uses the supervised learning classification algorithm, which was inspired by the \"process of self-tolerance of B-cells, and CLONALG, which is inspired by clonal selection theory and consists of mutation and selection processes\" [37]. The method works in two phases: the detector generation phase, and the matching and detection phase. First, the method generates detectors that do not match the protected data; then, it keeps matching these detectors with the data. If a match occurs, it means a change has happened in the protected data and action must be taken. This method was first introduced in [38], and the main idea was to develop a method that has similar techniques to the human immune system, where the system is capable of distinguishing between self-cells (the body cells) and non-self-cells (antigens). In computer networks, we map the self-cells to authorized system files and non-self-cells to malicious files. The detector generation and the matching and detection phases follow data representation and matching rules. Data representations are fundamental differences between many models of negative selection algorithms. It changes the matching rule process, detector generation, and the detection process. The main data representation method for this method is binary, assuming that all datasets are eventually implemented as binary bits. Other representations include numeric data, categorical data, boolean data, and textual data. These different representations could be grouped into two different categories: string representation and real-valued vector representation. The matching rule defines matching or recognition, which is the distance measured between the tested data and generated detectors. It is used in both the detector generation stage and detection stage. For all data representations, matching rule M can be formally defined as a distance measure between d and x within a threshold, where d is a detector and x is a data instance [39]. This matching rule introduces the concept of partial matching, where the detector and the data instance do not have to be exactly the same in every single bit to be matched. For example, if we have 11001100 as data, and we are applying a matching distance of 3, matched detectors could be (11001100, 1100111, 1100100, 00101100, etc.) where at least 5 bits match the original data of the detector. This approach works by monitoring a wide network. Each copy of the detecting algorithm is unique, which means that if a copy at one site is found, the other sites still have their different copies. The detection is probabilistic, which means that there are different sets of detectors to protect each entity. In addition, the method should detect any foreign activities rather than checking for a certain pattern (for example, signature-based malware detection methods). The positive selection method (inspired by negative selection) is inspired by the process of T-cell selection, where only T-cells that can recognize self-molecules (body cells) are used in the immune system. Unlike the negative selection method, this positive selection will generate detectors that recognize and match the self-protected data. Then, during the detection stage, if there is a detector that does not match the protected data, it means that some changes have occurred to the protected data.