## 4 Analysis and Findings of Research Questions
### Research Question 2: What Are the Detection Mechanisms of APT Attacks on Mobile Phones?
#### 4.2.3 IoT Device APT Detection Mechanisms  
In a study by [145], 5G network slicing is explained, and a technique is developed for isolating user device testing on a dedicated test network slice. This concept permits the detection and analysis of the most sophisticated malware on a device. Furthermore, a detection solution for Android malware based on the leave one feature out (LOFO)principle was introduced [146]. The suggested technique is designed to select essential Android application properties for effective Android malware detection by training several tree-based classifiers at the lower level. In some studies, detection techniques were applied to smartphones as part of the IoT network [151; 152]. They provided a distributed denial-of-service (DDoS) intrusion detection model that is deployable in dynamic IoT settings. Thus, it provides an intelligent intrusion detection technique against the second most serious threat to data transit and transfer on IoT networks [151]. A strategy dependent on machine learning algorithms for optimizing the time required to identify a MITM in a network was also presented [152]. A technique for detecting and classifying APTs in I-IoT was provided by [154]. Numerous machine learning techniques were adopted to identify and categorize dangerous IoT devices vulnerable to APT assaults. In order to develop such a system, the dataset KDDCup99 was utilized. The comparison of machine learning approaches revealed that the AdaBoost classifier surpasses the others with 99.9% accuracy and a 0.012 s execution time for identifying APT assaults, which is acceptable for usage in the I-IoT area. Moreover, a local outlier factor (LOF) and an autoencoder were devised for detecting suspicious behavior deviating from usual behavior [153]. Additionally, DDefender identifies and displays associated dangers by analyzing suspicious events and matching them against the conditions defined in the attack profile. Lastly, in [121], bounded rationality was presented in the SDN-based honeypot dynamic defense APT. The simultaneous dynamic attack and the defense process using the prospect theory were modeled. The dynamic interaction between the attacker and the defender has been formulated using a DBHM, and the bounded rationality has been expressed through a Prelec function and a weighting function. Based on the analysis of studies regarding the second research question, it is observed that various techniques are used to detect APT attacks targeting computers and smartphones. While existing techniques for detecting APT attacks have attempted to provide solutions, they have not been entirely successful due to a lack of focus on human behavioral factors and the complex nature of APT attack trails or TTPs. The APT defense solutions have centered around recognizing, preventing, spotting, and counteracting APT attacks. Machine and deep learning are the most popular methods to detect APT attacks. Threat scenarios from APT malware, such as ZooPark, are constantly evolving, posing difficulties for existing detection methods to keep up. Due to the dynamic nature of the threats faced, it has been unfeasible to develop a complete picture of the TTPs of APTs [32]. Notably, most APT detection methods have concentrated on the communication channel between the attacker and the C&C server. The component of APT malware in question plays a crucial role in receiving persistent instructions and the exfiltration of stolen data. Host-server interactions typically occur at low and slow rates and are frequently camouflaged as regular packets of network traffic. The hypertext transfer protocol (HTTP) is used for most communication and generally behaves similarly to any other form of network traffic. Over 90% of APT intrusions use the HTTP for communication. The main benefits an attacker can reap from using the HTTP for network-wide communication are convenience and ease of access. First, the communication protocol is used by all organizations worldwide.