# Security Vulnerabilities in LPWANs--An Attack Vector Analysis for the IoT Ecosystem
## 2 Systematic Review  
To perform the systematic review, the PRISMA checklist [34] was used as a reference, where some parts have been adapted to the topic under study. Initially, the following set of Questions were defined and the systematic review is expected to answer each of these questions:  
* **Q1**--Given the technologies LoRa, Sigfox, LPWAN, and NB-IoT, what is the progress in the number of papers published? * **Q2**--In the specific range of technologies (LoRa, Sigfox, LPWAN, and NB-IoT), which security-related topics have been addressed by the researchers? **Q3--**Given a set of security related topics, what are its relation to LPWAN, LoRa, Sigfox, and NB-IoT? **Q4--**What is the progress of research papers using the range of technologies (LoRa, Sigfox, LPWAN, and NB-IoT) and the set of security-related topics? **Q5--**What is the progress of research papers using the range of technologies (LoRa, Sigfox, LPWAN, and NB-IoT) and the set of security-related topics regarding the smart application's context (such as smart campus, smart environment, and smart monitoring)? The systematic review follows a defined process, to structure and organize the entire research. A diagram of the systematic process is presented in Figure 3, which identifies all the phases, from the questions to the results. After defining the questions, cf. Section 2, the selection of the search engine was performed. In this work, we opted for the IEEExplore database, since, when compared to other types of search engines (Google Scholar, Scopus, Arxiv, MDPI, DOAJ), was the one that demonstrated greater capacity and being user-friendly when using relatively elaborated queries (with different types of fields). Specifically, it can use more than four types of keywords in one search query, and thus, all the queries defined could be easily implemented. In the \"Define keywords\" step, a list of keywords was defined to be used in the construction of the queries. Defining the right keywords (e.g., attack, lora, LPWAN, exploit, security) according to the theme under study, are relevant to answer the questions. The keywords were divided into three main categories: Security-related \"Security\", Technology-related (\"Tech\"), and smart-based environments (\"Smart\"). In each category, the keywords were defined as presented in Table 1.  
The following step is to \"Define Queries\". To elaborate the queries, the keywords were arranged and combined. The queries accepted by IEEExplore search engine obey to the following format: (\"Document Title\":lora OR \"Document Title\":sigfox OR \"Document Title\":LPWAN OR \"Document Title\":nb-iot) AND (\"All Metadata\":attack)--this query returns articles where the document title includes \"lora\" or \"sigfox\" or \"LPWAN\" or \"nb-iot\" and in all metadata, the word \"attack\" exists. The queries were defined and grouped in the same categories of the keywords and, in total, sixteen queries were performed as follows in Figure 4. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Security Keywords** & **Tech Keywords** & **Smart Keywords** \\ \hline generic & lora & generic \\ attack & sigfox & smart \\ defense & lpwan & smart campus \\ exploit & nb-iot & smart environment \\ security & - & smart monitoring \\ privacy & - & - \\ vulnerabilities & - & - \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Defined keywords. Figure 3: Systematic Process Diagram. In the \"Data extraction & synthesis\" step, all the publications obtained by the queries had their information collected regarding the following information:  
- Title and abstract of the articles;  
- Authors names;  
- Publication year;  
- Type of vulnerabilities/attacks/security mechanisms/defenses. In the \"Process Data\" step, to select the relevant literature, inclusion and exclusion criteria were set.