# Advanced Persistent Threats and Their Defense Methods in Industrial Internet of Things: A Survey
## 2 Definition and Development of APTs  
The definition of APTs is a new attack and security threat to a specific target by organizations (especially governments) or small groups using advanced attack methods. APTs are organized, targeted, covert, disruptive, and persistent. Unlike ordinary attacks or hacks, APTs are sophisticated, continuously latent, and difficult to track. Through works [7; 8], the main characteristics of APTs are (1) well-targeted and harmful; (2) well-organised and well-resourced; (3) multiple attacks and continuous attacks; and (4) highly covert and difficult to trace. In Table 2, we compare traditional attacks and APTs in seven respects.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Feature** & **Traditional Attacks** & **APTs** \\ \hline Attack mode & \begin{tabular}{c} Viruses, worms, and \\ ransomware \\ \end{tabular} & \begin{tabular}{c} Social engineering, exploit, \\ and backdoor attack \\ \end{tabular} \\ \hline Purpose & \begin{tabular}{c} Acquire property or destroy \\ the system \\ \end{tabular} & \begin{tabular}{c} Long-term access and control \\ system \\ \end{tabular} \\ \hline Discovery difficulty & \begin{tabular}{c} Easily detected and \\ intercepted \\ \end{tabular} & \begin{tabular}{c} Difficult to detect and \\ intercept \\ \end{tabular} \\ \hline Attacker skill & Basic skills and tools & Advanced skills and tools \\ \hline Defense strategy & \begin{tabular}{c} Antivirus software, firewall, \\ and encryption \\ \end{tabular} & \begin{tabular}{c} Network monitoring, \\ intrusion detection, and \\ response system \\ \end{tabular} \\ \hline \multirow{2}{*}{Consequence} & \
\begin{tabular}{c} System interruption or \\ data loss \\ \end{tabular} &
\begin{tabular}{c} Data leakage, financial loss, \\ and reputation damage \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table}
Table 2: Comparison between traditional attacks and APTs.  
APTs have been studied for many years and pose a serious threat to IoT equipment [30]. APTs not only cause significant financial losses but also threaten human life safety [31]. The most significant feature of APTs is that they can evade high-level security systems, steal or manipulate information, and have a negative impact on equipment [32]. Stuxnet, an example of an APT, is a malicious virus that specifically targets industrial control systems. It disrupted the power generation plan of an Iranian nuclear power plant, delaying the program for four years [33]. The work [34] shows that Stuxnet infected over 45,000 industrial networks worldwide. Table 3 lists some famous APT attacks in recent years. Through these examples, we can draw the conclusion that APT is characterized by an extremely strong purpose; extremely advanced and complex attack methods, which were used before the vulnerability circle was made public; and finally attacks with a long attack time span, and hidden attacks.  
As a result, APTs have long durations and significant impacts. Studying the propagation patterns of APTs in IIoT and effective defense strategies against APTs in IIoT has become a critical and meaningful research topic for many scholars and companies. This is particularly crucial for preventing security issues in IIoT.