# Cyber Resilience and Incident Response in Smart Cities: A Systematic Literature Review
## 3 Results Analysis and Discussion
### Key Themes
#### 3.3.4 Data Source Analysis  
Through this research, a lack of available real datasets from CPS systems was identified. Although experimentation was carried out, predominantly this was limited to software-based simulations (46%) and simulation infrastructure (42%) by the primary studies, as shown in Figure 11. The infrastructure-based simulations typically relied on testbeds to replicate real-life CPS device settings such as a secure water treatment (SWaT) or water treatment plant (WTreat) testbeds [109, 119]. However, in 12% of the studies published between 2018 and early 2019, public scientific datasets like BATADAL [110] or CAIDA [125] were used either solely or in conjunction with software-based simulation. Carrying out experimentation in an isolated environment limits the testing in a number of ways. For example, the unavailability of a current real dataset limits the reflection of the current threat types and limits the full contextualisation of the actual CPS devices' constraining factors such as resources or connectivity disruptions. .3.5 Analysis of Primary Studies Cross-Sector Proposals or Applications to Improve Digital Forensics  
The purpose of analysing the cross-sector proposals or applications in smart cities is to explore transferable solutions that emerge from individual smart sectors to investigate possible trends and attempts to improve digital forensic investigations. To achieve this, the primary studies were organised accordingly to the smart sector's distribution according to the scope of our research, as shown in Figure 12.  
The scientific community focused the research on smart infrastructure, followed by smart mobility and smart security sectors whilst smart healthcare and smart citizen were addressed only by a small number of studies, see Figure 12. Some of the studies address more than one themes, which is taken into consideration. This trend could be explained by the influences of key events such as Industry 4.0 and the maturity of the research of the design principles and enabling technologies in these areas [1] whereas the lack of research within the smart healthcare and smart citizen sector could be impacted by regulatory restrictions, ethical challenges, lack of relevant usable datasets and the current health care models or pathways [145]. The results show that some studies address more than one smart sector [104, 120, 126, 133, 145] or aim to diversify their future research [39, 51, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 134]. For example, reference [145] explores smart support for independent living of the elderly within the community to maximise their independence whilst maintaining the ability to deal with their complex medical needs across multiple smart sectors including healthcare, homes and infrastructure. Furthermore, several studies consider developing their research to generalise applicability to other smart sectors and acknowledge the need for framework adaptability as a result of complexity and constant change of interconnected devices [133]. For example, the principles and techniques applied by reference [102] could be applied to other physical processes than the one covered by the study, whilst reference [131] suggest their methods can be applied in a number of CPS domains such as power networks, transportation, oil and natural gas systems. Although the cyber threat landscape is changing from hobby-hacking to organised cyber-crime, the cyberattacks are becoming more sophisticated, organised and targeted; there is little scientific evidence of attempts for supporting modern digital forensics, cross-organisational information security sharing or coordination [28]. Security practices remain in silos lacking collaborative cyber defences to deal with the increased sophistication and coordination of cyberattacks including advanced persistent  
Figure 11: Data source referenced by the primary studies.