# Advanced Persistent Threats and Their Defense Methods in Industrial Internet of Things: A Survey
## 4 APT Analysis Model
### Diamond Model  
The diamond model [87] is a framework used for analyzing advanced persistent threats (APTs). It consists of four key elements: the adversary, infrastructure, victim, and action. According to the diamond model, in APT attacks, the adversary targets specific victims using its controlled infrastructure and capabilities to achieve its objectives. The attacker and infrastructure are the initiating factors, while the victim and action are the targets and results of the attack. The following is a detailed explanation of the diamond model for APTs [88; 89]. * Adversary: Refers to the person or organization that initiates the APT attack. They typically have clear intentions, as well as the technical and resource capabilities to execute long-term, covert, and complex attacks. Understanding the characteristics and capabilities of the adversary is essential for predicting their next actions and taking appropriate defense measures. * Infrastructure: Refers to the hardware and software resources used by the attacker. This includes CC servers, botnets, malware, exploitation tools, and encryption technologies. The attacker's infrastructure often changes and evolves to avoid detection and monitoring by security defense measures. * Victim: Refers to the person or organization that suffers the APT attack. Victims can be government agencies, military organizations, businesses, or individuals. APT attacks typically use social engineering, exploit vulnerabilities, use phishing attacks, and use other methods to obtain sensitive information or disrupt the victim's systems, thereby achieving their attack objectives. * Action: Refers to the specific actions taken by the attacker during the incident, such as stealing confidential information, damaging systems, or monitoring the victim. Understanding the attacker's actions can help the victim assess the extent of the \begin{table}
\begin{tabular}{c c c} \hline \hline
**Model** & **Step** & **Characteristic** \\ \hline Lockheed Martin network & Reconnaissance, weaponization, delivery, utilization, installation, command and control, and action & Based on military terminology, it is assumed that the attacker performs the \\ kill chain [81; 82] & Initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, aggregation, penetration testing, and impact & steps in a linear order with malware as the center \\ \hline Unified kill chain [85] & Reconnaissance, weaponization, delivery, utilization, installation, command, and control, action target selection, data collection, data leakage, and data destruction & Pay attention to the attacker’s tactics, techniques, and procedures, which are nonlinear, finer-grained, and more comprehensive \\ \hline XDR framework/ & Reconnaissance, weaponization, delivery, utilization, installation, command, and control, action target selection, data collection, data leakage, and data destruction & Combining the advantages of Lockheed Martin and MITRE, the target and behavior of the attacker are described in more detail \\ \hline XDR framework/ & Reconnaissance, weaponization/delivery/utilization, command and control/action, and abnormal user behavior & Adapt to the framework of the XDR platform, pay attention to threat detection and response across terminals, networks, and clouds, and ignore traditional steps \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Attack chain model and its development. damage and take measures to repair their system and prevent similar attacks from occurring again. The work [90] used the diamond model to analyze APTs; discussed the social and political background and intention of APTs; and helped us understand the core issues of APT activities, such as who, what, when, where, why, and how. References [91; 92] used the diamond model to analyze the characteristics and behavior of APTs and how to use the diamond model combined with attribution technology to detect and defend against APTs.