## 5 Discussion
### The Proposed Conceptual Framework for APT Detection on Smartphone Sensors (FORMAP)
Additionally, the mobile application usage data and timing information can be utilized to identify the precise day and length of time spent in any given application [190]. **L1**: The situation awareness model has been proposed to select the risky permissions, information sensitivity, and behaviors utilizing the SIGPID model to detect dangerous permissions. Furthermore, it has been suggested that a data-mining technique could be used to extract the risky permission based on a set of association rules for risky permission [216]. Androguard could be used to decompile the applications associated with the dataset to extract permissions from them. It proposes extracting many different types of possible permissions to construct the feature set list. These permissions included permission rate, type, and the sizes of the applications to undertake static analysis and explicitly grasp each application's behavior. After identifying the list of permissions, filtering, finalizing, and retrieving the essential features will be used to specify the most important permissions to differentiate malicious and benign apps [217]. Permissions are assigned one of the four protection levels, which describe the potential risks they may entail and impose various install-time approval procedures. These four levels are normal, dangerous, signature, and signature or system. Users are only asked for their express consent for dangerous permissions such as CAMERA, READ_CONTACTS, ACCESS_FINE_LOCATION, and READ_PHONE_STATE [218,219]. Contrarily, vulnerability assessments locate the security gaps that an adversary can penetrate from a distant location and exploit. The primary goals of solutions based on the detection of malicious behavior are the analysis of malicious behavior and preventing malicious apps from being installed on the device [220]. **L2**: In this threat refinement level, the TTP fingerprint is generated and configured to identify the APT assault during the design stage. The correlation between the virtual sandbox detection and the MITRE framework creates the fingerprint. Sandbox is a type of application emulator which can identify malicious behavior by running the program in a sandbox before bringing it into the real world. Typically, it is used to detect zero-day attacks or modified malware. An APT assault infiltrates a target system utilizing a zero-day vulnerability. Consequently, detection using a virtual sandbox is required for APT defense [221]. In the meantime, MITRE ATT&CK methods and processes analyze cyber artefacts gathered from the network and end system to give behavioral observables for identifying assaults. Analysts can use the framework of TTPs to categorize opposing actions into procedures corresponding to specific strategies and tactics to better understand what an attacker may be trying to accomplish and how to defend against them. While MITRE ATT&CK details various possible attack methods, it fails to suggest how an adversary might combine them to achieve their objectives. The significance of technique associations lies in their ability to enable analysts to make predictions regarding previously unseen techniques, drawing from those that have been observed in the TTP chain. In the absence of technique associations, an analyst may encounter difficulties in effectively reasoning about adversarial behavior, as the search space grows exponentially with the quantity of techniques provided [70]. **L3**: In process refinement, AI techniques such as game theory have been proposed throughout the development level due to their capability to investigate the consequences of cyber security attacks and defensive activities in different communication and information contexts within society [203]. Such a condition is achieved by simulating behavioral sequencesthat maximize the benefits of defenders and mitigating the threat posed by the attackers based on input data and the detection design of the proposed conceptual framework. Furthermore, it can obtain high precision and performance while offering an efficient model.