# Advanced Persistent Threats and Their Defense Methods in Industrial Internet of Things: A Survey
## 6 Open Research Problem
However, some of these algorithms have been proven to be insecure against quantum attacks. Therefore, a more robust encryption algorithm is needed to adapt to these communication protocols, such as quantum-resistant NTRU and BLISS algorithms. In addition, a lightweight but secure algorithm is highly sought after to protect the limited resources of industrial IoT (e.g., low-energy, low-storage, and low-bandwidth communication). For example, RC5, SkipJack, high security lightweight (HIGHT), modified block TEA (XXTEA), and SAFER++ have recently been proposed to protect wireless sensor networks [127; 128]. * Data-centric approach. The data-centric approach aims to protect the data itself, rather than targeting different networks, communication technologies, and protocols for protection, regardless of when and where. As there is no single security mechanism and framework that can cover the entire industrial IoT ecosystem, data-centric approaches can serve as an alternative solution for IIoT end-to-end security. These data-centric approaches include homomorphic encryption, attribute-based encryption schemes, private information retrieval schemes, searchable encryption schemes, and multiparty computation schemes [129; 130]. These schemes mostly ensure the security of data in transit, data in transformation, and static data, thus greatly addressing interoperability and scalability issues across IIoT and technology integration with different security mechanisms. * Investigate the hacker community. In addition, investigating the hacker community can help identify zero-day vulnerabilities before they are exploited. According to [131; 132], some vulnerabilities have been discussed by the black hat community before being publicly exposed by ethical organizations. Hackers interact and communicate with each other through forums, which are user-oriented platforms whose sole purpose is to enable communication among hackers around the world. These so-called dark web forums are usually very similar to other normal web forums, where they discuss programming, hacking, and network security [133; 134]. These forums provide an opportunity for hackers from around the world to exchange their findings, customized tools, and malware. The existence of such hacker communities is common in various geopolitical regions, including the United States, Russia, the Middle East, China, and other regions. This is an increasingly serious global problem. Research in this area has the potential to have a huge social impact [135]. * Cloud computing. Another area that affects APT defense systems is cloud computing. Cloud computing provides different types of services and resources that can be used to send, store, or process data. For defense systems for organizations without cloud resources, they can monitor data leakage to unknown or external IPs. However, for organizations with cloud resources, detecting leakage activities can be very challenging, and this is an area that needs to be explored due to the multiple cloud resources and services that can be used to leak data. The proposed defense system should have a strong correlation model that can correlate interrelated activities involving stealing organizational data. For example, attackers can use the target organization's cloud storage service to steal data instead of sending data directly to their command and control center through the organization's network. Using storage services requires attackers to steal the credentials of cloud users in the organization who have permission to place or retrieve objects from that storage service. Once credentials are stolen, they can upload data to storage resources and download data to their command and control center without being detected using the same credentials.