## 4 Analysis and Findings of Research Questions
### Research Question 2: What Are the Detection Mechanisms of APT Attacks on Mobile Phones?
#### 4.2.1 Personal Computer APT Detection Mechanisms  
In research by [119], a cyber kill chain approach was adopted to detect an APT on a personal computer. Utilizing an industry-recognized cyber kill chain technique for dataset reconstruction enabled improved resolution of the attack phases and alert types, which are crucial for APT attack analysis. Notifications were carefully organized, with one warning potentially correlating to numerous attack phases determined by the APT lifecycle within the cyber kill chain framework. While identifying APT attacks, the authors [120] devised  
Figure 10: APT Defense Method Classifications [16]. a novel technique entitled APT-Dt-KC. Bayesian algorithm classification prioritization and selection were implemented to select training data and significantly increase the runtime efficiency. According to research by [121], deception is a potential strategy for detecting assaults. This approach can identify attacks irrespective of the attacker's skill and ability levels. Additionally, it provides a comprehensive APT detection methodology, implements it, and tests it against two scenarios. Furthermore, in research by [122], the fractal dimension-based machine learning classification strategy was implemented for APT detection. This approach proposed utilizing the transmission control protocol/Internet protocol (TCP/IP) feature vector to mitigate APT effects. The authors posited that their technique outperformed more established machine learning methods, for instance, the K-nearest neighbor (KNN) algorithm. Additionally, the authors of [23] proposed a distinctive machine learning approach named MLAPT, which is capable of systematically detecting and forecasting APT assaults with high accuracy and speed. Some studies presented the definition of network genes, an innovative network application technique that integrates the semantically rich activity characteristics model [123]. It is feasible to assess a network entity action's identity significance and source similarity to identify network applications by matching network activities to network genes. Similarly, an effective anomaly-based detection strategy for robots and APTs was investigated using a data mining technique with applicable classification techniques [124]. Furthermore, spatiotemporal association analysis was identified as a method for detecting an APT attack within an industrial network, enabling the successful identification of the APT attack's stealing behavior [19]. Several researchers proposed detection mechanisms using network traffic flow with a combination of one of the machine learning algorithms, such as support vector machine (SVM), with deep learning undertaken to detect, monitor, and analyze the APT attack in the system [125; 126; 127; 128]. A strategy for identifying APT attacks based on monitoring access to unfamiliar domains was previously proposed by [116]. As a recently developed IT technology, big data technology provides several technological advantages for Internet-enabled applications while potentially providing excellent framework support for APT detection [128]. In studies by [129; 130], situation awareness models have been adopted to detect APTs. An APT alerts and logs correlation technique (APTALCM) has been recommended to accomplish cyber scenario understanding. Initially, a cyber scenario ontology was developed to model ideas and attributes to formalize APT attack operations and detect APT attack goals. It was presented to measure the similarity of cyber scenario cases based on the SimRank approach [131]. Nevertheless, a study by [132] presented APTPMFL, a federated learning-based APT prediction technique for fifth generation (5G)-enabled IoT. Training a model using various APT attack patterns was undertaken using a distributed learning technique. The final result was used to anticipate the likelihood of future APT attacks in 5G-enabled IoT scenarios.