## 4 Analysis and Findings of Research Questions
### Research Question 2: What Are the Detection Mechanisms of APT Attacks on Mobile Phones?
#### 4.3.1 AI Techniques/Algorithms Used to Detect APTs in Personal Computers
A multistage game of incomplete data, where each participant possesses secret knowledge unknown to the other players, captures the stealthy and deceiful behaviors. The major problem of this technique is determining the value and practicability of the activities of defenders and users during each stage. A study by [161] included a game model that was developed to deal with the issue in accordance with the APT attack route. Before presenting the optimal defensive strategy, the game equilibrium was calculated and the attacker's best revenue path was generated. Dynamic information flow tracking (DIFT) has also been suggested as an APT detection method. This study created a dynamic information flow monitoring game for resource-efficient detection of APTs, using multistage dynamic games [162; 177]. In [163], the evolutionary game theory was adopted to illustrate the ongoing long-term activities of APTs on cloud storage. Furthermore, a hyper-game involving an attacker and a defender has been developed. The actors may perceive the same game differently and select their optimal strategy according to their individual perspectives [164]. A basic framework that splits a generic APT into three primary temporal periods was also presented in a study [165]. The DIFT has been presented as a viable approach for detecting and preventing various cyber attacks in computer systems [166]. The authors of [146] proposed an explainable APT edge protection method. Their recommended approach provides instructions and explanations for constructing the edge defender's protection strategy and resource allocation system to identify APTs. It amalgamates edge gaming and AI techniques based on APT attack intelligence to present a solution and an explicable foundation for an edge defensive system and resource allocation. In the publications by [167; 168], a fog computing platform was used to develop a novel game technique for cyber risk management. The cyber insurance concept was adopted to transfer cyber security threats from the fog computing platform to a third party. Accordingly, three primary entities comprising the system model were under consideration: the fog computing provider, the attacker, and the cyber insurer. In addition to that, Ref. [178] has examined a particular scenario wherein APT attacks are utilized to launch attacks against industrial Internet of Things (I-IoT) devices. A node-level state evolution model has been developed to assess the likelihood of compromise by an APT across all devices within an industrial Internet of Things (I-IoT) system, taking into account the APT's lateral movement. The study proposes a Stackelberg game model for the APT attacker and defender, which effectively captures the dynamics of the gaming process. A continuous-time propagation model has been established to depict the lateral movement in I-IoT devices. Subsequently, a Stackelberg game model is formulated to depict the sequential interaction between the APT attacker and defender. A study [180] presents TI&TO, a two-player game that simulates a realistic scenario wherein an attacker and a defender compete for control over resources within a contemporary industrial architecture. The validation of opinion dynamics through the lens of game theory serves to illustrate its efficacy as an initial countermeasure for mitigating and