AI/ML-Based Multi-Stage Detection and Automated Defence Against Advanced Persistent Threats: A Review and Conceptual Framework

Advanced Persistent Threats (APTs) are targeted, long-term cyberattacks that unfold in several stages and are deliberately designed to stay hidden, so detecting them from isolated alerts is unreliable. Machine learning (ML), behavioural analysis, event correlation, provenance analysis and security information and event management (SIEM) are increasingly applied to this problem. This paper reviews fifteen studies published between 2018 and 2026 that cover APT tactics, techniques and procedures (TTPs), supervised, deep, hybrid and evolutionary detectors, provenance-graph learning, attack-stage prediction and uncertainty-aware classification. A criterion-based comparison shows that none of the reviewed studies combines full-lifecycle coverage, multi-source data fusion, prediction of the attacker’s next action, handling of uncertainty and drift, and validation in a realistic environment. To address this need, we propose a conceptual framework for multi-source data fusion, multi-stage detection, stage and next-action prediction, uncertainty-aware prioritisation and automated response, and define an evaluation protocol for it. The framework is proposed rather than implemented; open challenges and future directions are discussed.