## 4 Analysis and Findings of Research Questions
### Research Question 2: What Are the Detection Mechanisms of APT Attacks on Mobile Phones?
#### 4.3.1 AI Techniques/Algorithms Used to Detect APTs in Personal Computers  
The relevant research regarding this question has been observed to include different types of cyber attacks targeting specific platforms, such as personal computers and smartphones. On the one hand, as observed in Table 11, the AI techniques used against personal computers were machine learning [23; 119; 122; 156; 157], deep neural networks [158], game theory [159; 160; 161; 162; 163; 164; 165; 166; 167; 168], fuzzy neural networks [169; 170], and anomaly detection [123]. In research by [112], several machine learning classifiers were adopted, including naive Bayes, Bayes net, K-nearest-neighbor (KNN), random forest, and SVM. Additionally, Weka performance measures were employed to display the numerical findings. The primary obstacle was the minimal number of features of the dataset. This situation was addressed by extracting features and selection techniques. In contrast, Ref. [163] offered an anti-phishing system with the ability to identify phishing URLs in real time without third-party information and in a very short response time. This method was designed to detect phishing assaults with high accuracy based on a limited number of characteristics. The evaluation used four distinct algorithms: random forest, K-nearest-neighbors, logistic regression, and SVM. [PERSON] et al. [23] recommended a MAPT model based on machine learning for detecting APTs. It is divided into three parts: detecting threats, predicting attacks, and alert correlation. This study presents MLAPT, a unique machine learning-based method with the ability to predict APT attacks. Furthermore, a study constructed a fractal-based machine learning algorithm to enhance phishing detection approaches [122] by utilizing machine learning techniques [157]. It is recommended that an AI-enabled APT detection system based on blockchain is used to defend against the forging of industrial IoT data [171]. Incorporating reusable machine learning methods at the IoT edge protects information before its transmission in cyber space. One study applied a deep embedded neural network expert system (DeNNeS), enabling extraction of improved regulations from an educated deep neural network design to replace an expert system's knowledge base [158]. Moreover, the present study of [172] aimed to enhance the efficacy of APT malware detection on endpoints. To achieve this objective, the researchers have developed the GECA combined model utilizing the intelligent cognitive computation approach (a combination of GE and CNN-Attention). The model has been successfully constructed. The optimization of two problems through the implementation of intelligent cognitive computation techniques has resulted in an enhanced capacity for malware detection. Initially, the technique of extracts behaviors of APT malware through process analysis. Secondly, the techniques employed for detecting APT malware are based on behavior analysis. The proposal has effectively introduced a GE network that is grounded on the graph convolutional network (GCN) for the purpose of synthesizing and extracting malware behaviors that are process based. A computational system based on intelligent hybrid models was proposed and constructed by [158]. It enabled the development of expert systems with the capability to attack various sorts of cybernetic data by utilizing fuzzy rules. Nevertheless, a study conducted by [170] attempted to identify and predict unknown \"zero-day\" phishing emails through the introduction of a novel framework known as the phishing evolving neural fuzzy framework (PENFF). It focused primarily on using evolving fuzzy neural networks (EFuNNs). A gene-based technique comparable to traffic data analysis was applied to identify the APT. It recognizes certain similarities to APT assaults by utilizing the pattern of previously occurring attacks. This approach was paired with anomaly detection [123]. In [156], a machine learning and malware-based classification scheme for APT groups was suggested.