## 4 Analysis and Findings of Research Questions
### Research Question 2: What Are the Detection Mechanisms of APT Attacks on Mobile Phones?
#### 4.3.2. AI Techniques/Algorithms Adopted to Detect APTs in Smartphones
Furthermore, a dynamic game model utilizing double Q-learning (DQL) is suggested as a countermeasure to APT attacks. Ultimately, the study conducts a comparative analysis between the proposed approach and established methodologies, namely the Q-learning algorithm, Sarsa algorithm, and Greedy algorithm. The findings of the experiment demonstrate that the suggested approach is capable of efficiently mitigating the attack inclination of APT attackers, enhancing the usefulness of authorized users, and safeguarding the security of the fog computing environment. The authors of [187] proposed a unified architecture for early detection of DDoS attacks organized by a botnet that controls rogue devices by utilizing deep convolutional neural networks (CNNs) and actual network data. As there were constraints in the dataset, this study aggregated three hours of data within approximately 60 days and treated them as previous data from a ten-minute slot. The authors of [186] have devised an architecture called Fed-IIoT to identify Android malware in I-IoT. Fed-Android IIoT's malware detection system, which includes different identically distributed learning models, is mandated. This research faced a significant barrier regarding the most pervasively adopted and well-known mobile operating system for processing and communication. Installing an Android operating system on IoT-based platforms may improve access to a broad range of apps. Expanding threat detection for a malicious mobile application is vital to analyze risks and provide decision makers with situational awareness [26]. The study presents a method for analyzing threats based on extracted characteristics derived from Android malware detection through fundamental machine learning techniques, such as risk modeling and factor analysis of information risk (FAIR). Furthermore, the study discusses the relationship between mobile risks and cyber space, threat assessment, and the limitations of mobile malware detection. Moreover, this article presents frameworks for the threat assessment technique based on situational awareness. The findings of the threat assessment for Android malware applications were discussed in the outcome of the threat assessment section. Finally, a study developing a deep autoencoder neural network aimed to classify APT attack types [116]. This model's advantage is its high classification rate by discovering intricate relationships between database characteristics. Apparently, lowering the quantity of data in the encoder facilitates the classification of massive amounts of data. Based on the evaluation of research studies related to the third research question, several challenges were identified regarding using AI techniques to identify APTs in smartphone sensors. Machine learning and deep learning were found to be popular AI approaches, particularly on smartphones. Notably, there is a lack of studies using game theory or fuzzy logic as an AI strategy for detecting APT attacks on smartphone sensors. Detecting and preventing APT attacks can be challenging due to their complex nature and the limited understanding of potential attack paths. Additionally, utilizing AI approaches for smartphone APT detection involves numerous challenges, including a lack of training data, restricted smartphone resources, mobile platform heterogeneity, adversarial attacks, and privacy concerns. A comprehensive analysis of the technological considerations involved in building effective and efficient AI-based APT detection solutions for smartphones would be required [189; 190; 191].