## 1 Introduction
Thus, financial and privacy loss and reputational damage are the main impacts that can harm the systems of individuals and organizations. Thus, smartphones have become the principal target of attackers undertaking APT assaults [12] including AndroRat [13], FinSpy [14], and Asacub [15]. Extensive use of third-party mobile application stores and the risk of lost or stolen smartphones add to the potential vulnerabilities, making them more susceptible to APT attacks. Due to the stealth, flexibility, and persistence of APTs, detecting such attacks using existing strategies, such as network monitoring and analysis, endpoint detection and response, user behavior analysis, and data loss prevention (DLP) technologies, can be challenging. Various security technologies are available to detect and prevent the exfiltration of sensitive data from an organization, a common objective of APT attacks [16; 17]. In order to penetrate the system, hackers use social engineering methods, zero-day vulnerabilities, and long-term latent approaches [18]. Ultimately, high-level security networks are becoming increasingly vulnerable to this threat [19]. Various vulnerabilities in smartphones lead to APTs. For instance, the large surface of attack occurs due to heterogeneous mobile network protocols (Wi-Fi, SMS, GPS, email, web) and vulnerabilities in smartphone sensors as a result of sensor data being accessible by default and having no permissions [20; 21]. Consequently, APT is deemed as a highly sophisticated variant of multistep assault [22]. Given their sophisticated methodologies and usage of previously undisclosed vulnerabilities, APTs pose a challenge to current detection tools. The economic costs of a successful APT attack can be tremendous, and investments in intrusion detection and prevention systems are often motivated by the potential costs of such attacks [23]. A broad range of cyber threats, such as malware and suspicious activity that potentially leads to phishing attacks, may be detected using AI, which can analyze millions of datasets in minutes. As new forms of assaults are discovered through AI application, it is constantly refined and enhanced [24; 25]. Despite studies having been undertaken and several APT solutions developed and implemented, none has offered a comprehensive solution. The reason is due to several challenges and limitations. Firstly, there is insufficient fingerprinting of APT attacks. Fingerprinting of attacks uses sequential tactics, techniques, and procedures (TTPs). Due to difficulties in detecting an APT assault, attackers may utilize various strategies and approaches to launching it. User behavior for tackling APT has never been conceptualized and comprehended. Thus, user actions for handling smartphones while using mobile applications, completing job-related tasks, the environment and surrounding contextual parameters, user intentions, and device permission have not been clearly and precisely defined. With no data on normal user behavior, there is no distinction between APT security attacks [26]. The second limitation is the issue of characterizing the interconnected attack routes formed by APT attackers when they exploit vulnerabilities [27]. Due to the dynamic APT attack process, this form of attack is constantly evolving. The success of an APT attack can be influenced by two factors: how the attack is carried out and when it is launched. Similarly, the security approaches implemented for personal computers, such as desktops and laptops, may also be performed for mobile devices, such as smartphones. On the other hand, cell phones have a few distinguishing characteristics that lead to significant issues with ensuring their security [28]. For example, products designed for the general public, such as smartphones, are typically open platform systems with multiple entry points and central data management, making them vulnerable to theft and loss. Additionally, embedded sensors and limited battery life can further increase their security risks [29].