# Advanced Persistent Threats and Their Defense Methods in Industrial Internet of Things: A Survey
## 1 Introduction
### Contributions  
When facing APTs in IIoT, [PERSON] et al. [14] implemented network security policies and measures to directly prevent APTs. The work [15] identified APTs through detection technology to prevent attacks. Reference [16] provided various methods to protect IIoT equipment and data. For defending against APTs, there are specific measures in three directions. 1. Strategies and measures including network isolation, access control, and encryption [14]. Network isolation refers to isolating IIoT from other networks to prevent APT attacks from spreading to IIoT [17]. This approach can reduce the scope of attacks, but it also reduces system flexibility and availability and requires more management and maintenance costs. Access control refers to authenticating users and equipment \begin{table}
\begin{tabular}{c c c} \hline \hline
**Feature** & **IoT** & **IIoT** \\ \hline \multirow{2}{*}{Definition} & Internet system connecting equipment and networks & Internet of things system applied in industrial field \\ \hline \multirow{3}{*}{Application area} & Family, medical care, agriculture, & Factory automation, \\  & urban management, and transportation & quality control, and logistics \\ \hline \multirow{2}{*}{Equipment types} & Smartphones, watches, and & \\  & home appliances & Robots, sensors, and PLC \\ \hline \multirow{2}{*}{Communication mode} & Wireless network technology & Communication protocol \\ \hline \multirow{2}{*}{Data transmission} & Large quantity, little influence on transmission speed & Little quantity, great influence on transmission speed \\ \hline \multirow{2}{*}{Usual network structure} & Smart equipment and cloud services & Multiple types, multiple levels \\ \hline \multirow{2}{*}{Usual security risks} & Personal information, behavioral habits & Key infrastructure, production safety, and personnel health \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison between IoT and IIoT. and controlling their access to ensure system security [18; 19]. This approach can provide some security guarantees, but it requires maintaining and managing a large amount of authentication information, increasing management costs. Encryption technology refers to using encryption technology to protect data transmission and storage [20]. This approach can provide a certain degree of security guarantee, but it may have a certain impact on system performance, and there is a risk of password cracking. However, these methods affect the smoothness and efficiency of production and industrial processes. Moreover, they cannot completely prevent APT attacks as attackers can use advanced techniques to bypass these measures. 2. Detection technologies include network traffic monitoring-based, anomaly detection-based, attack graph-based, behavior analysis-based, and artificial intelligence-based methods [15]. The network traffic monitoring-based method detects and analyzes abnormal data flows and behaviors in the IIoT network by monitoring the network flow to identify possible APT attacks [21; 22]. However, this method depends on the accuracy and efficiency of flow monitoring. If attackers adopt covert attack methods such as staged attacks and forged traffic, this method may not effectively detect attacks. The anomaly detection-based method models the behavior of IIoT system equipment and users and detects abnormal behavior to identify possible APT attacks [23]. This method requires sufficient data training and modeling and also needs to handle a large number of false positives and false negatives. It also needs to overcome the challenge of attackers adopting covert attacks. The attack graph-based method identifies possible APT attacks by analyzing the attacker's attack path and target on the IIoT system [24]. This method requires comprehensive security modeling and attack graph analysis of the IIoT system, but the components and connections in the IIoT system are often very complex. Therefore, the modeling and analysis work of this method requires a high human and time cost.