Advanced Persistent Threats (APTs) are among the most dangerous and sophisticated types of cyberattacks, capable of infiltrating enterprise networks and staying hidden for long periods while stealing data or causing damage. Unlike random cyber threats, APTs use stealth, persistence, and adaptive tactics to evade traditional defenses. This article examines the unusual activities caused by APTs within network environments, focusing on how Artificial Intelligence (AI) can be used to detect these anomalies effectively. We start by explaining the basics of APTs, their lifecycle, and features that make detection dif-ficult. Then, we review a wide range of anomaly detection methods, especially those driv-en by AI. A detailed mathematical framework for identifying anomalies is presented, in-cluding hypothesis testing, change-point detection, probabilistic models, and graph-based learning techniques. The development section describes AI-based detection methods, with mathematical details and pseudo-code. Results from controlled experiments and bench-marks like UNSW-NB15, CIC-IDS2017, and CTU-13 are analyzed, followed by a discus-sion of strengths, limitations, and future research directions. The article wraps up with strategies for deployment and a plan for real-world implementation.
Brandão et al. (Tue,) studied this question.