## 3 Malware Attack and Effective Detection Method
### Artificial Immune Systems (AIS) for Detecting Malware Attacks in IoT  
AIS is a leading malware detection method that has been proven effective and suitable for IoT systems [5]. It is a digital security method that mimics the human immune system mechanisms in response to antigens. Specifically, AIS replicates how the B and T cells defend the human body at the time of an attack. B cells are activated when an attack (antigen) enters the body, upon which, the B cells mark the antigen by attaching to it and providing antibodies. When an infection occurs, T cells are activated to kill the infected body cells and keep a record of the attack using memory T cells (refer to [5] for more details on B/T cell functionality). There are four main AIS methods used in security applications (such as malicious process detection, anomaly detection, intrusion detection, scan and flood detection, and fraud detection). The _first_ is the negative selection method, which is a supervised learning method that replicates the B cell technique in marking an antigen. The _second_ is the positive selection method, which replicates the T cell technique in defending the human body. The _third_ is the clonal method, which is based on the B cell cloning antibody technique for specific antigens. The _fourth_ is AIS, which is an unsupervised classification method based on B memory cells for identifying an attack. AIS methods are adaptive, distributed, and not computationally expensive. Thus, they are a good fit to secure the ever-changing IoT environment with lightweight IoT devices. The AIS work presented in [5] focuses on an AIS-based method for unknown malware detection in the IoT. The method is based on a negative and positive selection (NPS) technique that works in two stages: a detector generation stage and a detection stage. During the detector generation stage, two different sets of detectors are generated. The first set is a positive detector set containing detectors that match self-data based on the positive selection concept. The other set is a negative detector set, which contains detectors that do not match self-data based on the negative selection concept. The performance of NPS outperforms that of the state-of-the-art by achieving a 21% increase in the malware detection rate while reducing the number of detectors by 65% (directly related to a reduction in memory and computational power requirements). The work in [22] builds on this theoretical study and presents a performance analysis of the NPS method when implemented in realistic IoT systems using Amazon Web Services (AWS). Different IoT system architectures are studied with IoT devices and gateways with differing memory sizes (see Figure 1). This work investigates the feasibility of running the AIS algorithm on individual IoT devices for malware detection. While the approach demonstrates effectiveness on constrained devices, the authors suggest deploying the algorithm on the IoT gateway for improvedprotection of all connected devices under the same hub. This centralised approach reduces the computational burden on individual devices and potentially offers broader protection. As shown in Table 1, which uses NSL-KDD [23], NPS outperforms the state-of-the-art MNSA method [24] and effectively detects malware attacks. It should be noted that the MNSA results in Table 1 are produced by implementing the method from [24] in the AWS systems described in Figure 1. To evaluate the proposed approach, four performance metrics are used, i.e., _accuracy_, representing the rate of correctly classified samples (malware and benign), _precision_ and _recall_, which measure the rate of correctly detecting malware with respect to all malware or all samples, respectively, and the _F1 score_, which combines the last two metrics. In the case of an unbalanced dataset, such as the NS-KDD, the detection rate is better represented by the F1 score, which best reflects the rate of correctly classified malware and benign files.