Salim Duraid Thamer, Singh Manmeet Mahinderjit, Keikhosrokiani Pantea
School of Computer Sciences, Universiti Sains Malaysia, Penang, 11800, Malaysia.
Department of Computer Science, College of Basic Education, Mustansiriyah University, Baghdad, Iraq.
Heliyon. 2023 Jun 16;9(7):e17156. doi: 10.1016/j.heliyon.2023.e17156. eCollection 2023 Jul.
Advancements in computing technology and the growing number of devices (e.g., computers, mobile) connected to networks have contributed to an increase in the amount of data transmitted between devices. These data are exposed to various types of cyberattacks, one of which is advanced persistent threats (APTs). APTs are stealthy and focus on sophisticated, specific targets. One reason for the detection failure of APTs is the nature of the attack pattern, which changes rapidly based on advancements in hacking. The need for future researchers to understand the gap in the literature regarding APT detection and to explore improved detection techniques has become crucial. Thus, this systematic literature review (SLR) examines the different approaches used to detect APT attacks directed at the network system in terms of approach and assessment metrics. The SLR includes papers on computer, mobile, and internet of things (IoT) technologies. We performed an SLR by searching six leading scientific databases to identify 75 studies that were published from 2012 to 2022. The findings from the SLR are discussed in terms of the literature's research gaps, and the study provides essential recommendations for designing a model for early APT detection. We propose a conceptual model known as the Effective Cyber Situational Awareness Model to Detect and Predict Mobile APTs (ECSA-tDP-MAPT), designed to effectively detect and predict APT attacks on mobile network traffic.
计算技术的进步以及连接到网络的设备（如计算机、移动设备）数量的不断增加，导致了设备之间传输的数据量有所增长。这些数据面临各种类型的网络攻击，其中之一就是高级持续性威胁（APTs）。高级持续性威胁具有隐蔽性，且专注于复杂的特定目标。高级持续性威胁检测失败的一个原因是攻击模式的性质，它会随着黑客技术的进步而迅速变化。未来研究人员了解文献中关于高级持续性威胁检测的差距并探索改进检测技术的需求变得至关重要。因此，本系统文献综述（SLR）从方法和评估指标方面研究了用于检测针对网络系统的高级持续性威胁攻击的不同方法。该系统文献综述涵盖了关于计算机、移动设备和物联网（IoT）技术的论文。我们通过搜索六个领先的科学数据库进行了系统文献综述，以识别2012年至2022年发表的75项研究。根据文献的研究差距讨论了系统文献综述的结果，该研究为设计早期高级持续性威胁检测模型提供了重要建议。我们提出了一个概念模型，称为检测和预测移动高级持续性威胁的有效网络态势感知模型（ECSA - tDP - MAPT），旨在有效检测和预测对移动网络流量的高级持续性威胁攻击。
