## 4 Analysis and Findings of Research Questions
### Research Question 2: What Are the Detection Mechanisms of APT Attacks on Mobile Phones?
#### 4.3.1 AI Techniques/Algorithms Used to Detect APTs in Personal Computers
This technique relies on behavior data annotated with APT organization tags gathered from the dynamic analysis of APT malware on IoT devices to generate relatively robust feature vectors through feature representation and feature dimensionality reduction. Meanwhile, Ref. [173] presents a novel approach for identifying APT malware on workstations. This approach involves analyzing the behavioral profile of malware through the use of a deep learning graph network. The study successfully proposed three initial objectives. The paper proposes anomalous behaviors as a basis for process classification and reports that supervised machine learning algorithms and deep learning models have yielded favorable and consistent outcomes. The novel concept of scrutinizing and extracting malware conduct through processes in event IDs has yet to be posited by any scholarly inquiry. The development of an effective behavior profile facilitates the monitoring system's ability to extrapolate and amalgamate not only the procedures engendered by a given executable file, but also the interconnections among said procedures and their corresponding levels of risk. Moreover, Ref. [174] presents an algorithm for generating adversarial examples in the APT domain. The algorithm was successfully utilized to execute a gray-box attack on an APT detection model. The findings demonstrate that the emergence of adversarial examples can be attributed to the elevated linearization of the targeted model. Furthermore, the transitive nature of the adversarial example has been established, which has enabled the successful implementation of a black-box attack on the APT detection model. The production of APT adversarial examples that have achieved success suggests that a potential avenue for future research in the realm of APT attack detection will involve developing effective defense mechanisms against potential adversarial attacks. Additionally, Ref. [175] presented a novel methodology that utilizes a fusion of deep learning networks and attention networks. The study outlines a proposed methodology for detecting APT attacks, which is delineated as follows: initially, all network traffic data undergo preprocessing and are subsequently subjected to analysis by the CNN-LSTM deep learning network. This network is a fusion of a convolutional neural network (CNN) and long short-term memory (LSTM). Subsequently, rather than being employed directly for categorization purposes, the data are scrutinized and assessed by the ATTENTION network. Ultimately, the ATTENTION network's output data are utilized for the purpose of APT attack identification. A study [176] has put forth a novel approach for classifying malware that is based on deep learning. This approach integrates time sequence features and association rule features to achieve its objective. The study employed the RESNET_LSTM and PARALLEL_LSTM neural network architectures, which have been enhanced for improved performance, to extract temporal features from diverse protocol traffic. Moreover, it employed association analysis for the purpose of producing rule features that are quantitative in nature. Ultimately, the time sequence feature vector and the quantization rule vector were integrated as inputs into deep learning models for the purpose of identifying malicious network traffic. Several studies investigating the adoption of game theory as an AI technique to detect APT on personal computers have been reviewed. Nevertheless, due to the unpredictability of attack durations and the wide range of possible detection outcomes, there are challenges to using this approach effectively. Researchers [159] used cumulative prospect theory to analyze APT detection and the effect of end-users' subjectivity in detecting APTs during unknown assault durations. In another study, a dynamic gaming framework was devised to present the long-term interplay of a stealthy intruder and a proactive defender [160].