## 4 Analysis and Findings of Research Questions
### Research Question 2: What Are the Detection Mechanisms of APT Attacks on Mobile Phones?
#### 4.3.2. AI Techniques/Algorithms Adopted to Detect APTs in Smartphones  
According to the data presented in Table 12, the AI techniques adopted concerning smartphones were machine learning, deep learning, game theory, and deep conventional neural networks. Research by [53] investigated how APTs on mobiles may be undertaken through spear phishing through URL hijacking and how they may be detected. The technique achieved over 90% accuracy. However, the study's shortcoming was the limited dataset and the usage of only a single user's browser history. According to [142], the DNS of APT attack software on mobiles and PCs is vastly different. Despite adjusting the canopy and K-means clustering method characteristics, the detection impact failed to fulfill expectations, while there was a limit to the number of extracted features. The authors of [182] introduced OmniDroid, a comprehensive collection of characteristics collected from 22,000 genuine malware and goodware samples, to support developers and researchers in producing anti-malware solutions by enhancing or creating novel procedures and tools for Android malware detection. Nevertheless, the study was limited to investigating the Android operating system. Furthermore, there is an opportunity for improving the OmniDroid dataset, with the dataset of OmniDroid being restricted in terms of the number of retrieved features and samples. Several studies investigated the effectiveness of deep learning in identifying AI [148; 183; 184; 185]. The user-friendly Android application DDefender was presented. It has the capacity to detect malicious apps on devices [148]. Nevertheless, the study's weakness was that it examined 4208 distinct programs, with a 50/50 mix between benign and malicious code. Realistically, this distinction is not adequate. The dataset should be expanded to include additional non-malicious programs, as there are many more. \begin{table}
\begin{tabular}{c c} \hline \hline
**Techniques/Algorithms** & **Article** \\ \hline Machine Learning & [26; 182; 183; 184; 184] \\ Deep Learning & [148; 184; 185] \\ Naive Bayes & [183] \\ K-Nearest-Neighbors (KNN) & [183] \\ Game Theory & [159] \\ Support Vector Machine (SVM) & [183] \\ Logistic Regression & [183] \\ Deep Neural Network & [116] \\ Gradient Boosting & [183] \\ Federated Learning (FL) & [186] \\ Deep Convolutional Neural Networks (CNNs) & [187] \\ Double Q-learning (DQL) & [188] \\ \hline \hline \end{tabular}
\end{table} 
Table 12: AI Technique Algorithms Adopted for Detecting APTs on Smartphones. In [183], the authors recommended BetaLogger, an Android-based application, as a solution to address the issue of the leaking of smartphone users' private information. This study's shortcoming indicates that it must be strengthened with additional advances in deep learning, permitting the model to make predictions down to the sentence level. As recommended by the authors of [184], DeepAMD is an effective and functional means of detecting and identifying Android malware on both the static and dynamic detection levels. The study's focus on the Android OS and its susceptibility to new types of attacks is a limitation, considering the widespread use of iOS on millions of devices. The paper by [185] presents a new 5G-orientated cyber security architecture to swiftly and efficiently identify cyber threats in 5G mobile networks. The architecture uses deep learning algorithms to investigate network traffic and extract information from the flows to achieve this condition. In order to effectively comprehend how a cyber system and an APT attacker interact, the researchers employ the cumulative prospect theory (CPT) to examine the two parties' interactions [159]. Furthermore, a defense mechanism against APTs has been suggested by [188], which relies on the double Q-learning (DQL) algorithm of MFC. Prospect theory (PT) is employed to construct a stationary subjective game model that involves APT attackers and lawful users.