# AIS for Malware Detection in a Realistic IoT System: Challenges and Opportunities
## 1 Introduction  
The Internet of things (IoT) paradigm is continuously revolutionizing the world we live in through innovative IoT applications. As a result, the number of IoT devices has increased exponentially since 2002 when small security cameras were installed, and the market is expected to grow to USD 11 billion in 2026 [1]. IoT systems consist of lightweight devices connected to the internet giving a real-time interaction in advanced networks [2]. Lightweight devices indicate devices with a small battery, small memory, and constrained processing power, thus with limited options for complex security methods [3]. The proliferation of IoT devices and their spiral role in critical applications, such as e-health and smart cities, increases the risk of security attacks. In fact, in the first six months of 2021, there were almost 1.5 million attacks against IoT devices [4]. As detailed in [3], the interconnectivity of IoT devices and the exposure of often private data pose a major security challenge to the spread of IoT systems. Postquantum cryptosystems for the Internet of things is discussed in [5] with a focus on the emerging lightweight lattice-based cryptography (LW-LBC) as a promising solution to secure data transmission in view of its low-power footprint, narrow area, lightweight bandwidth requirements, and good performance. This work focuses on IoT malware attacks which are malicious files that areinstalled on devices by hackers without the user's knowledge or permission. One of the major malware attacks was in March 2021 against Verkada [6]. Hackers managed to gain access to the company's security cameras invading the privacy of many major locations, such as hospitals and police stations. In the past years, many effective methods have been proposed to detect such attacks. These methods can be categorized as either signature-based or behavior-based [3]. The signature-based technique consists in comparing incoming files to an existing list of known malware attacks. This method suffers from two drawbacks. Firstly, often times, malware files are encrypted which would then require extensive processing time to extract their signature. Secondly, signature-based techniques are limited to detecting known malware and fail to detect new attacks. In contrast, the behavioral-based technique can detect unseen malware since it is designed to analyze the behavior of the file rather than reading its signature. To this end, this technique first collects and interprets information about the incoming file and matches it with the known legitimate behavior of benign files. However, behavior-based techniques are complex and computationally expensive, and their effectiveness is negatively impacted with the increase in the number of files to be examined. Readers are encouraged to refer to [3] for a detailed survey of malware detection techniques in the IoT and other systems. Signature-based methods are not sufficient to secure IoT devices from unknown malware attacks. Moreover, behavior-based methods are expensive to install in IoT devices. Indeed, online detection of malware-attacks on IoT devices is extremely difficult, which has led researchers to consider an alternate approach which consists in shrinking the attack surface in order to reduce the threat of the attack [7]. Such an approach would require IoT devices to undergo stringent security tests before being deployed. A promising emerging approach for malware detection in currently deployed IoT systems leverages artificial immune systems (AISs). AIS methods emulate the behavioral patterns of the adaptive immune system within the human body to identify and detect attacks [8]. AIS methods are lightweight, adaptive, and distributed, hence fitting the requirements of IoT malware detection. The advantages of using AISs to secure the IoT systems are discussed in [3, 9], showing that the NPS is the most promising method compared to state-of-the-art solutions.