## 1 Introduction  
Cybersecurity is responsible for establishing security policies; these policies set out the steps to follow for data to be managed within the technological infrastructure in an organisation. However, some security flaws and vulnerabilities (e.g., the use of outdated equipment, use of policies that are not reviewed continuously, failing to install updates at time, awareness deficiency) allow attackers to realise an intrusion in an organisation.  
The increasing development of sophisticated tools used by cybercriminals, such as zero-day vulnerabilities and denial of service (DoS) attacks, conventional solutions cannot cope with the current complexity of these types of threats.  
Nowadays, advanced persistent threat attacks represent a real threat to public and private entities around the world and will continue to do so in the future [1]. These attacks are an imminent threat, whose main problem is the difficulty of early detection because attackers use different techniques, both to stay as long as possible undetected, and to evade efficiently.  
The differences between an advanced persistent threat (APT) and a common cyber-attack are significant. For example, the number of resources of all kinds necessary to carry out the attack. A common cyber-attack can be directed to entities or organisations with null or deficient cybersecurity policies in order to steal customer or financial activity data of a company [2]. These attacks are usually detected, and the damage caused is not usually critical. However, an APT can be focused on large organisations and industry sectors, causing severe damage, e.g., intellectual property theft, failure of essential services, and destruction of critical infrastructure. These attacks are usually undetected, and the damage caused can be critical.  
In recent years, the number of reported APT related cases has increased significantly [3; 4]; one of the main objectives of APT attackers is to remain undetected. Some researchers have proposed different approaches to understand and detect this type of threat. They can be observed that the life cycle of this attack is an indicator to understand how these attacks work [5; 6; 7]. Furthermore, the machine learning techniques have allowed for the collection and analysis of tools used by attackers to improve the early detection of these attacks.  
An example of the scope that APT can have is that actors take advantage of current issues that generate interest in the general population. The actual situation of the COVID-19 has generated the right scenario for actors to launch their attacks. In this case, the lure has been advisory information about healthcare situation in different countries, for these techniques such as spear-phishing, exploits with remote access tools and ransomware have been used [8].  
The aim of this paper is to propose a new approach to APT detection using machine learning techniques, and based on the life cycle of an APT attack. The proposed new five-stage model more precisely matches the passive and active components of an APT attack.  
The rest of paper is organised as follows, Section 2 gives an overview of APT attacks process. In Section 3, the techniques and algorithms used for APT detection are described. In Section 4, the APT life cycles are analysed. In Section 5, the discussion is presented, and finally, in Section 6 the conclusions are shown.