## 5 Discussion
### The Proposed Conceptual Framework for APT Detection on Smartphone Sensors (FORMAP)  
In a broad sense, situation awareness is the perception of environmental elements within an amount of time and space by understanding their meaning and predicting their future status [207]. The sensor data fusion techniques combine the information gathered from several sensors, making the algorithms more accurate in distinguishing between the various activities [208]. Additionally, using data from various distributed sources allows a lower probability of detection errors and higher reliability [209]. The JDL data fusion model is a reference model that outlines the comprehensive procedure of fusing data derived from various sources to understand the observed situation better. This model describes the technical information processes of gaining situation awareness [76]. Algorithms can be used at each stage of the fusion process to combine data and draw conclusions regarding the data based on their context [210]. The JDL model classified the data fusion process into five processing levels: L0 (source preprocessing), LI (object refinement), L2 (situation refinement), L3 (threat refinement) and L4 (process refinement). A conceptual framework has been proposed, as shown in Figure 11, to present a solution to overcome all the challenges relating to the process of APT detection on smartphones. Data collection: Prior to implementing the five levels of the model, the source stage was applied to collect the data from smartphones. It comprises numerous components, specifically mobile sensing, smartphone applications, APT, and use logging [211]. Various sensors are included in contemporary smartphones, including GPS, Wi-Fi, cameras, micro phones, accelerometers, and gyros. Each sensor can sense distinct components of the user context, chosen and set according to the application's requirements. Additionally, it collects information using the mobile application's features [212]. Based on the frequency, duration, and temporal and spatial patterns, determining the usage logs is possible for sensor data, smartphone applications, and APT attacks. **L0**: Data preprocessing is the lowest level of the data fusion process. It is considered one of the significant steps in this model and is used to convert raw data into useful and efficient patterns. It includes filtering, correcting the data, and extracting features using Kalman filter algorithms. The data at this stage are refined while being useful to higher-level operations [209]. Notably, data correction procedures should be carried out when collected data fail. Data correction entails using sensor data imputation techniques to estimate missing or inconsistent values [208]. Subsequently, the feature extraction phase is important, where different features are extracted from the raw data. Several features can be extracted using static and dynamic analysis. The features acquired using static analysis rely on command stings, API calls, intentions, and permissions [213]. In order to reduce complexity, eliminate noise, and enhance the model's effectiveness, feature selection chooses only the most crucial features based on their ranking [214]. Data annotation: It has been proposed to adopt the K-means clustering algorithm and continuous authentication for annotating unlabeled raw data to detect trusted and non-trusted data. In a continuous authentication system, the attributes such as networks,  
Figure 11: Proposed Conceptual Framework for APT Detection on Smartphone Sensors (FORMAP). connections, applications used, and sensors are monitored while a user uses the mobile device [215]. During the training phase, the vast amounts of sensor data available on mobile devices are used to discover a template or multiple templates for the authorized user. Moreover, the templates are constantly being used in the background for authentication purposes during typical use. The phone will automatically begin restricting access to the most private apps and features based on how far the user deviates from the device presets.