## 2 Related Work
While, as already mentioned, several techniques adopted data fusion to improve the detection performance to enable the detection of APTs, more recently, several works have particularly addressed the detection requirements for APTs. [PERSON] and [PERSON] briefly in [31], and more elaborately in [7] developed a game theoretical approach to address the detection of APTs. In the formulated game, the attacker follows network protocols and the change of patterns to evade detection, while the user designs the security policies to deter cyber attackers. [PERSON], et al. [32] adopted machine learning techniques, and suggested that deep learning techniques encapsulating multi-layered extraction of features may exhibit the best performance for the timely detection of APTs. [PERSON], et al. [33] concluded that the Adaboost classifier outperforms other machine learning algorithms for detecting and classifying complex APT signatures. [PERSON], et al. [34] adopted an ensemble machine learning approach building on eight distinct detection methods. Subsequently, the authors used correlation techniques to distinguish related alerts. Lastly, the authors developed an attack prediction technique that estimates the probability of future similar APTs. [PERSON], et al. [35] developed a semi-supervised learning approach that uses network characteristics to detect APTs. Finite state machines were employed to model the state transitions and to infer the presence of APTs in the case of deviations. Lastly, we mention the work of [PERSON], et al. [8; 9], where opinion dynamics was suggested to track APTs through all of its stages. As demonstrated, opinion dynamics can correlate different anomalies measured over time, thus aggregating the persistence of threats. As shown above, the scientific literature provides a rich palette of anomaly detection techniques applicable to the detection of APTs. These techniques range from simple statistical computations to more complex frameworks embracing the latest machine learning algorithms, and data aggregation, alongside correlation techniques. Compared to prior works, the approach documented in this paper distinguishes itself as follows. First, to the best of our knowledge, the documented technique is the first approach to embrace an active attestation methodology for the detection of APTs. Accordingly, the developed technique actively triggers an expected behavior from the underlying physical process, which can effectively reduce the time to detect the presence of such APTs. In comparison, since prior techniques focused on observation, without embracing active intervention, they cannot detect, for example, (apparently) inactive compromised components, since such components are inactive as part of normal operational planning. Second, the developed technique comprises additive and multiplicative operations, which, compared to more advanced machine learning techniques, provide higher chances of integration in a distributed industrial realm, where computational power is not homogeneous. We note, however, that the approach proposed in this paper can also be viewed as complementary to existing anomaly detection techniques. More specifically, related techniques can indicate a possible raising suspicion on the presence of APT. Subsequently, the proposed approach can bring additional evidence on the presence of APT by triggering critical components and expecting a particular dynamics that can be monitored and observed for possible abnormalities.