## 1 Introduction
### Related Work  
The detection of APTs has challenged current defense systems in cyber security. Different SLRs and review articles have been undertaken to discuss and analyze the detection of APTs. Recent models have been developed and significantly contributed to the cyber security field to help understand the behavior of APT attacks. Table 1 presents previous review studies. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \multicolumn{1}{c}{**SLR**} & \multicolumn{1}{c}{**Year**} & \multicolumn{1}{c}{**Type**} & \multicolumn{1}{c}{**Period**} & \multicolumn{1}{c}{**Techniques**} & \multicolumn{1}{c}{**NIST**} & \multicolumn{1}{c}{**Framework**} & \multicolumn{1}{c}{**Review Focus**} \\ \hline
[30] & 2023 & Systematic & 2017–2023 & Game theory & Detection & No & Game theory approaches & & \\  & & & & & & & & & \\  & & & & & & & & & \\  &  
For instance, [PERSON] et al. [30] studied and analyzed the research articles published in various journals between 2017 and 2022. The studies utilized game theory to deal with APT attacks. According to the study, game theory proves to be a valuable tool in examining the dynamics of the interactions between attackers and defenders. It has been used to enhance security measures, prepare for countermeasures, and design contracts that benefit both parties. Furthermore, game theory has been applied to enhance the security of diverse systems, such as cyber-physical systems, social networks, and transportation systems. It is evident that game theory is a useful tool for analyzing and comprehending complex security situations in the face of technological advancements, evolving threat landscapes, and new trends in cyber crime. It is concluded that although APT attacks are expected to become increasingly sophisticated and evolve over time, game theory will remain a crucial tool for addressing them. Moreover, a detailed survey of [31] focused on recent advancements in deep learning-based malware detection techniques, tracing the evolution from traditional approaches. The study examined sandboxing methods, deep learning models, and the detection of emerging malware types, including ransomware and APTs, as well as traditional malware affecting IoT, Windows, Android, and iOS platforms. In contrast, [PERSON] et al. [32] studied and analyzed various defense mechanisms deployed to counter APTs on both networks and devices. In addition, the review has concentrated on and provided a detailed analysis of the risk management strategies used to detect APTs. The authors proposed the utilization of the observe-orient-decide-act (OODA) model as a means of generating mobile device behavior fingerprints for the purpose of defending against APTs. The model monitors device behavior to detect suspicious behavior in all stages of the APT lifecycle. The authors of [33] discussed the strategies and procedures that can be utilized to identify APTs, specifically to recognize beaconing, during the lifecycle of an APT. Many different AI algorithms have been determined to identify, analyze, and compare the characteristics of datasets and data sources used to put these detection techniques into action. In addition, the benefits and difficulties associated with many different APT beaconing detection techniques have been discussed. This SLR offered a broad overview of APT attack detection in smartphone sensors, applications, and services. It revised 96 papers on APTs in smartphones during the last decade. In addition, a comprehensive analysis [34] was conducted to investigate intelligent threat profiling strategies designed specifically for APTs. The evaluation focused on a wide range of topics, such as data processing, threat modeling, representation, and reasoning methods. The research highlighted the significance of threat profiling in developing an intelligent security ecosystem by presenting a framework for intelligent threat profiling to enable proactive defense against APTs.