## 4 Analysis and Findings of Research Questions
### Research Question 2: What Are the Detection Mechanisms of APT Attacks on Mobile Phones?
#### 4.2.1 Personal Computer APT Detection Mechanisms
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Platform** & **Detection Mechanism** & **Description** & **Article** \\ \hline \multirow{8}{*}{PC} & Cyber Kill Chain & A technique for reconstructing datasets to enhance the & \multirow{4}{*}{[119]} \\  & & resolution of attack phases and warning types. & \\  & & Analyzes, identifies, and prevents cyber attacks using the & \\  & APT-Dt-KC/Cyber Kill Chain & cyber kill chain concept and its fuzzy features against an & \\  & & APT assault. & \\  & & APT assault. & \\  & & A fractal-based APT detection method leveraging the TCP/IP & \\  & & feature vector to mitigate the APT’s impact. & \\  & & Machine-Learning & \\  & & Correlation Analysis & \\  & & Machine-Learning with & \\  & & XGB Classifier & \\  & & & \\ \end{tabular}
\end{table} 
Table 10: APT Detection Mechanisms. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Platform** & **Detection Mechanism** & **Description** & **Article** \\ \hline Graph2 vec Algorithm and & Profile analysis and an APT malware detection model & \\ Deep Learning & utilizing the graph2 vec algorithm and deep learning. & [134] \\ Evasive Maneuver Re-Engineering & Demonstrates how evasion techniques can be used to bypass & [135] \\ Framework (EMRF) & modern security solutions. & [118] \\ POIROT & Utilizes causal correlation-aided semantic analysis to detect & [118] \\ A Network Gene-Based Framework & A novel concept illustrating the network application’s & [123] \\ Flow Network Analysis Techniques & semantically rich behavior characteristics model. & [125] \\ Unknown Domains & A novel deep learning-based approach for detecting APT & [125] \\  & & \\ Unknown Domains & A technique for identifying APT assaults that relies on & [131] \\  & monitoring access to unknown domains. & \\ Big Data Processing & The big data processing technique provides several & \\  &  
Moreover, Ref. [136] presented CONAN, which delivers rapid and effective APT attack detection using an FSA-like state transition technique. A revolutionary framework for state-based detection was introduced, through which each process and file is represented as a well-designed data structure for real-time, long-term detection. For the first time, a study of open-source EDR enabled attack detection and coverage analysis for all APT attack phases, as defined by MITRE ATT&CK [137]. Several stages had a poor detection rate as a consequence of insufficient query parameters to identify detailed stage-specific assaults. The Teach model was implemented to undertake an in-depth performance evaluation, investigating assaults with high significance and low detection levels. Lastly, a semi-supervised learning strategy and complex network properties were introduced to demonstrate the evolution of the APT-AN [130]. A study [133] introduced a method for identifying APT attacks through the utilization of a recently constructed dataset specifically designed for these attacks. The dataset was utilized in a proposed machine learning model to identify APT attacks based on various attack categories. The study gathered five distinct categories of data, specifically normal, reconnaissance, initial compromise, lateral movement, and data exfiltration. Each type of data signifies a particular phase that the perpetrator could have potentially reached. The proposed model for detecting APT attacks utilizes machine learning techniques, specifically the extreme gradient boosting (XGB) classifier, in conjunction with the ANOVA feature selection method. Meanwhile, another study [134] aimed to develop a model for detecting APT malware on workstations through early detection and warning. The proposed approach involves utilizing the graph2 vec graph analysis algorithm and deep learning models to conduct profile analysis and build the APT malware detection model. This study addressed three problems through its research findings. The process profile of APT malware has been graphically represented to comprehensively illustrate its behavior.