# AIS for Malware Detection in a Realistic IoT System: Challenges and Opportunities
## 2 State-of-the-Art AIS Solutions  
AIS is a discipline influenced by the immune system of the human body. In the adaptive immune system of the human body, B-cells and T-cells work together as primary agents to recognize antigens [12]. Antigens are any foreign substance entering the body. Once an antigen is recognized, the immune system response is triggered to produce antibodies. Similarly, AIS methods use classifiers to detect any malicious files that are not part of the system [13, 14]. AIS methods require less computational power and time; therefore, they are a good fit for malware detection in the IoT [3]. We present promising state-of-the-art malware detection solutions using AIS techniques. The first AIS algorithm we review is a combination of negative selection and neural networks methods (NSSNN) for intrusion detection in the IoT [15]. The goal of designing NSSNN is to meet the IoT devices' properties, mainly lightweight and distributive. The highest F1-score that NSSNN achieve is 0.77 for denial-of-service attack detection. This approach is restricted to creating negative selection and employing a neural network. Also, only the simulation results of the methods are published, and there is no presented way to implement this method online. The second AIS algorithm we review is a combination of negative and positive selection for intrusion detection in the IoT (MNSA) [16]. The findings indicate that the MNSA algorithm can identify up to 34% of intrusions without prior knowledge about nonself. Furthermore, the MNSA can validate over 90% of the identified files. However, a significant drawback of this approach is that the results were achieved using random strings rather than real malware files. Moreover, the memory needed to generate detectors as calculated in [3] was very high, which does not make it a good candidate to secure the IoT systems. The third AIS algorithm we review is the NPS algorithm presented in [9]. The NPS uses a combination of negative detectors to recognize nonself data and positive detectors to recognize self-data. Also, the original negative selection algorithm generates 12-bit-size detectors, while the NPS generates 16-bit-size detectors. The authors prove the efficiency of combining both techniques and generating large-size detectors by presenting a high detection accuracy rate with minimal false negatives. The results presented are for a simulation of the NPS method and it was not run on a real-time platform. Since the NPS is the recent promising solution for malware detection in the IoT, in this work we first ran the NPS using multiple datasets. The aim of this experiment was to validate the accuracy of the detection results of the method under different circumstances, such as different malware attack types and different file sizes. Second, we implemented the NPS using a real-time platform. We created different IoT system architectures to test the AIS solutions efficiency in detecting unknown malware attacks while minimizing the memory utilization in the IoT device. We also implemented the MNSA, which is the second promising AIS solution for malware detection, using the same scenarios. We conducted a quantitative analysis studying the detection behavior of AIS solutions in a realistic setup. In the next sections, we present the AIS solutions methodology, the simulation results using multiple datasets, the implementation including the IoT system architectures and problem formulation, and results and discussion. Most of the presented AIS methods have inherent limitations when applied to IoT malware detection. For instance, NSSNN employ a neural network that requires a high computation power whereas the MNSA consumes a high amount of memory to generate the required detectors. Given that IoT devices are often constrained with respect to both computation power and memory, the promising model performance may not be applicable in a realistic scenario. The NPS algorithm stands out as the best-performing AIS model with the least memory and computation power requirements.