# Challenges of Malware Detection in the IoT and a Review of Artificial Immune System Approaches
## 4 AIS to Secure the IoT: Literature Review and Analysis
### AIS in Malware Detection in the IoT
#### 4.1.3 Immune and Artificial Immune Based Algorithms  
The authors in [56] presented an AIS-based algorithm for malware detection (DeepDCA). DeepDCA uses a dendritic cell algorithm (DCA), which is a danger theory technique, and Self-Normalizing Neural Networks (SNN). The proposed approach focuses on the preprocessing phase, presenting the feature selection, the SNN signal categorization, signal processing, and anomaly metrics steps. The Bot-IoT dataset was used in the experiment, converting some of the categorical variables to easily apply the feature selection method. The method was evaluated using different file features, resulting in an F1-Score less than 50% when using imbalanced data for the best 10 file features in the dataset. When using balanced data for the 10 best file features in the dataset, the F1-Score increased to over 90%. Although this method achieves a high detection accuracy rate with low false negatives, it is neither sufficiently lightweight nor distributive to be implemented in IoT devices.  
The artificial awareness architecture (AWA) was proposed by the authors in [57] as a model for artificial immune ecosystems. Their experiment shows that the proposed algorithm can detect intrusions in specific given IoT architectures; however, it does not detect outliers-anomalies.  
Moreover, the researchers in [58] proposed a novel approach to securing the IoT based on immunology techniques. The proposed method adopts dynamic and circular defense processes against a security threat. It incorporates five links: security threat detection, danger computation, security response, security defense strategy formulation, and security defense. The first link is responsible for collecting and analyzing IoT network traffic, and the other links function based on the produced results. The method simulates AIS techniques for intrusion detection based on the following mechanisms: capturing the IoT traffic data and simulating the data to antigens in AIS; representing the detector simulation for the detection elements, such as the living time and the number of recognized antigens; thirdly, implementing a matching mechanism to determine if there is a match between a detector and an antigen. Also, the evolution process is represented by classifying the detectors into immature detectors, mature detectors, and memory detectors. In the experiment, cloning attacks, mutated cloning attacks, replay attacks, and mutated replay attacks were simulated. Even though this method can detect security threats and change detectors to adapt to the dynamic IoT environment, no real malware files were used in this experiment. In addition, this work was not implemented in a real IoT scenario.  
Furthermore, the authors in [59] proposed an artificial immune-based method for intrusion detection in the IoT. The method involves many local intrusion detection sub-models that share their learning attainments. The signature information in the IoT sense layer represents antigens in this method as binary strings. Detector sets are generated, and they include a number of antigens matched by the detector and the generation life of the detector. One of the main limitations of the proposed method is that it is not sufficiently lightweight to meet the IoT system requirements.  
Finally, the authors in [60] proposed an AIS-based algorithm for intrusion detection in the IoT. It was claimed that the main signature information on the IoT datagram is extracted to be switched to a binary character string for experiment purposes. Different detector stages are identified as immature, mature, and memory detectors. The authors stated that immature detectors meet the recognition diversity of intrusion detection, while mature detectors evolve to be immature detectors. Although this paper presents a new method of detecting unknown malware in the IoT environment, no simulation results were given. In addition, we find this method to be memory space and time consuming for IoT devices.  
Table 1 shows a comparison of the AIS-implemented solutions for securing the IoT.