## 4 Analysis and Findings of Research Questions
### Research Question 2: What Are the Detection Mechanisms of APT Attacks on Mobile Phones?
#### 4.2.2 Smartphone APT Detection Mechanisms  
Numerous studies have analyzed smartphones' detection mechanisms, particularly for Android operating system devices and cyber attacks that target the IoT, such as MIMA [147]. Studies by [53; 141] investigated how an APT assault through spear phishing may occur on mobiles through URL hijacking by seeking to explain how they can be identified. The machine learning approach has achieved over 90% accuracy. This finding confirms that it has the ability to help mitigate APT attacks through spear phishing on smartphones [53]. An APT guard attempt was proposed to categorize the URL using a decision tree and neural network [141].  
In works by [142; 143], mobile domain name system (DNS) logging was used as an APT detection technique. Specifically, a method for APT attack detection on mobiles, based on analyzing DNS logs using a machine learning technique, was proposed [142]. According to the researchers, the DNS of the APT software on cell phones and laptops differs markedly. On the other hand, [PERSON] et al. [143] developed a technique for detecting APT attacks based on mobile DNS logging, which draws on four distinct datasets, including request of DNS, reply, and domain time-based features.  
A study [144] proposed a method that detects APTs by analyzing control flow of the binary code of the kernel. The control flow analysis compares the genuine kernel's control flow graph with the device kernel's control flow graph. It detects APTs using the fingerprints generated during the detection procedure.  
TriggerScope, a first step towards the automated detection of logic bombs, was suggested by [147]. It employs a novel static analysis approach for automatically detecting triggers in Android applications. DDefender, a user-friendly program for identifying dangerous Android applications on devices, is presented by the authors of [148]. DDefender employs a comprehensive solution that utilizes static and dynamic analysis approaches to extract information from the user's device.  
Subsequently, a deep learning algorithm was utilized to detect harmful programs. Finally, in research by [149], an enhancement of an escalation data analysis (EDA) was proposed. It is a technique for automating the detection of APT assaults that breach a node within an organization to steal data.  
Finally, Ref. [150] presents an automated system that specifically targets cyber attribution. The study was conducted utilizing the TTP framework of MITRE for mobile. Through the comparative analysis of the indicator of compromise (IoC), it was able to effectively mitigate the occurrence of false positives in the experimental study. Moreover, the automated method for detecting cyber attribution has been utilized to scrutinize 12 threat actors and 120 malwares. The implementation of this technology will facilitate the automated classification of tactics, techniques, and procedures (TTPs) for a multitude of mobile threats. Furthermore, through the provision of TTP and IoC pairs to the analyst, it becomes feasible to classify and identify potential mobile attackers.