# Advanced Persistent Threats and Their Defense Methods in Industrial Internet of Things: A Survey
## 1 Introduction  
The industrial internet of things (IIoT) refers to the application of internet of things (IoT) technology in the industrial field, achieving intelligent interconnection and data exchange by connecting various sensors, equipment, and networks [1]. IIoT aims to achieve digital transformation, increase production efficiency, reduce costs, improve product quality, and coordinate supply chains, with applications spanning fields such as manufacturing, energy, utilities, and transportation [2, 3].  
With the development of technology, IIoT is widely used in the field of industrial automation and intelligence, which helps to improve the efficiency and quality of industrial production. At the same time, IIoT is vulnerable to advanced persistent threat (APT) attacks due to its evolving technological paradigm [4]. The increasing interconnectivity of industrial infrastructure equipment has expanded the attack surface, making it a prime target for network attacks [5]. The threats facing the IIoT can not only cause enormous property damage but also threaten human life and safety [6]. APTs refer to the behavior of highly specialized hackers or cybercriminal organizations that use targeted, hard-to-detect, and long-lasting attack methods to attack a specific target [7]. Compared to traditional attacks, APTs are not used to disrupt services but mainly to steal intellectual property, sensitive internal business, legal documents, and other data [8].  
We summarize the reasons why IIoT is vulnerable to APT attacks as follows:* Complexity [9]: IIoT networks usually consist of equipment and systems, including sensors, controllers, gateways, and cloud services. The complexity of these types of equipment and these systems make them vulnerable to attacks, and attackers can hide and spread within them.
* Centralized control [10]: IIoT networks are usually managed by one or more central control systems, which can be invaded and controlled by attackers, thus gaining control over the entire network.
* Insecure design [11]: Many types of IIoT equipment and many IIoT systems are designed for ease of use, without sufficient consideration for security. For example, some types of equipment may use default usernames and passwords, making them vulnerable to password-based attacks.
* Lack of updates and patches [12]: Many types of IIoT equipment and systems run for long periods without updates and patches, making them vulnerable to attacks exploiting known vulnerabilities.
* Data sensitivity [13]: Data in IIoT networks are often sensitive, and attackers can use these data for espionage, ransomware, and other malicious activities.  
From an attack point of view, IIoT often involves more complex network architectures [4; 5] and usually involves higher security risks [6]. Through these works [4; 5; 6; 9; 10; 11; 12; 13], we compare IoT and IIoT in Table 1.  
In summary, IIoT provides great convenience for human production and life but also faces APT attacks. This review summarizes APTs and defense methods at each layer of the IIoT architecture and analyzes APT activities by establishing models.