# Challenges of Malware Detection in the IoT and a Review of Artificial Immune System Approaches
## 3 Artificial Immune Systems
### Artificial Immune Systems Methods
The Positive Selection Classification algorithm (PSCA) is a general classification algorithm that classifies unknown data using classifiers that can recognize self-class (system files) data. The authors in [37] applied PCSA to malware detection with the following steps: a learning stage, where the method learns how to classify data into two different classes (self and non-self), and stimulation and mutate stages. Finally, the radius is a threshold used for classification, as opposed to the usual classification approach where the minimal distance between several centers is used. The clonal selection theory was proposed in [40], and states that B-cells undergo cloning, variation, and selection to mature affinity. The CLONALG method was proposed by [PERSON] and [PERSON], and it is inspired by the clonal selection theory; the CLONALG method was initially designed for optimization and pattern recognition issues [41]. According to the authors in [36] CLOALG requires the definition of five main factors. The size of the receptor population, selection strategy, number of receptors, the affinity function that returns real-valued measure, and the function to assign the rate of mutation and the number of clones according to the affinity. A supervised data mining technique is used to simplify the cloning method. When an antigen enters the body, B-cells start cloning specific antibodies for that type of antigen, but if it is a new one, the immune system clones the most stimulated lymphocytes. Similarly, the CLONALG method generates a set of receptors R that can recognize a set of patterns P.  
Artificial immune network (AIN) theory was proposed in [42]. AIN is an unsupervised learning algorithm that was inspired by B-cells' immunological memory, due to the existence of a mutually reinforcing network of themselves. This process means that B-cells interact with each other to spread information so that memory can be preserved, and active behavior is exhibited even when no immune response is taking place [36]. AIN mimics immune network theory and parts of clonal selection as well. The goal of the AIN system process is to set up a collection of repertoires for a given issue, where better-performing cells stifle low-similarity (comparable) cells in the system. This standard is accomplished through an intuitive procedure of presenting the population to outer data, to which it reacts with both a clonal selection reaction and inner meta-elements of intra-population reactions. Thus, it balances out the reactions of the population to the outside boosts. As the human immune system can detect and react to antigens in our body, the AIS can determine and respond to malicious files that are different to the system files used in the training phase [43]. AIS can detect discrepancies in the system behavior and identify attacks without prior knowledge about them, which makes them ideal candidates for detecting unknown malware files. In the next section, we investigate the state-of-the-art AIS solutions in malware detection and in securing the IoT.