# Cyber Resilience and Incident Response in Smart Cities: A Systematic Literature Review
## 3 Results Analysis and Discussion
### Key Themes
#### 3.3.6. Typology Analysis  
The purpose of the typology analysis is to separate the non-empirical and the empirical studies and to examine their chronological distribution. This analysis helps to better understand if the CPS frameworks and systems supporting cyber resilience or modern DFIR are predominantly academic ideas built on theory or do they emerge based on identified needs or as a result of relevant events.  
Cyberattacks are a natural progression of physical attacks; they are more economical, reduce the risk for the attacker and have fewer geographical constraints. Studies from the sample recognised the cybersecurity risk factors that the integration of connected devices, sensors and automation helped by artificial intelligence have on smart ecosystems. In 2011, the focus of an [102] empirical study was attacks on sensor networks and their impact on the process control system. The research study referred to the example of the targeted ICS-based attacks such as the Maroochy Shire Council sewage attacks in Queensland, Australia in 2000; Ohio's 2003 Davis-Besse Slammer worm private network attack and the 2007 Iranian nuclear plant Stuxnet worm attack. The control systems' vulnerability such as Stuxnet and urban migration are also referred to by reference [107]. In 2007, the disruption and economic consequences of a large-scale cyberattack on the USA power grid were studied [108]. Several non-empirical studies investigated the theoretical concepts or potential challenges to be addressed for different aspects of the cyber defences against targeted attacks related to the increased interconnectivity and heterogeneity of the physical and cyber convergence. In 2014, the following study [21] investigated a federated building information system as a method of preventing hostile reconnaissance, managing intellectual property and enabling operational security. The study refers to a 2013 incident in Hackney, London in which a piling rig penetrated the roof of a Network Rail tunnel.  
Therefore, the proliferation of digital technologies and the integration of IoT with physical systems expands the scope of forensic science creating a need for new specialised forensic techniques to reduce the backlog, workload and the cost of the forensic investigation process [146]. Digital forensics (DF) has developed as a branch of forensic science alongside the conventional forensic disciplines covering diverse digital technologies that can be exploited by the criminals.  
The results presented in Figure 13 demonstrate the chronological trend between surveys, non-empirical and empirical studies. The focus of this SLR is on primary empirical studies. The total of the studies shows that non-empirical studies including the survey-type studies amounted to 64% compared with 36% of the empirical studies of the reviewed samples. Although the number of survey studies consistently increased, a sharp increase of the empirical research is observed during 2017 and a similar surge of the non-empirical studies is observed in 2018. Depending on this evidence, it is possible to argue that this dynamic could be influenced by the key events discussed in Section 1. Furthermore, from the empirical studies, it emerges that the focus of the research was informed by the threats of specific events, driven by the need for defence-in-depth mechanisms and influenced by the implementation of technological innovation and application within smart sectors.