## 1 Introduction  
The internet has significantly transformed our lives, bringing forth numerous benefits and advancements. However, growing reliance on the internet has also exposed various security flaws [1]. As a result, ensuring robust computer security is crucial to prevent unauthorized access and disruptions to services provided by computers and associated technologies [2]. Authentication serves as a fundamental method to mitigate unauthorized access [3; 4; 5], verifying the user's identity and allowing access only to authorized individuals, essentially demonstrating the principle of \"you are who you say you are\" [6]. Authentication plays a vital role in safeguarding sensitive data [7]. Authentication traditionally relies on three elements: something you know (knowledge elements), something you own (ownership factors), and something you are (inheritance elements) [7; 8]. Knowledge factors, also known as knowledge-based authentication, involve elements such as passwords, personal identification numbers (PINs), challenge-response mechanisms, or security questions [6; 7; 8; 9; 10]. Ownership factors, known as token-based authentication, rely on possessions such as ID cards, ATM cards, cryptographic keys, security tokens, and more [6; 7; 8; 9; 10]. Inherence factors, or biometric-based authentication, leverage unique user characteristics or behaviors, including fingerprints, retinal patterns, DNA sequences, signatures, faces, voices, bio-electrical signals, and others [6; 7; 8; 9; 10]. Within the realm of authentication methods, alphanumeric passwords have long been prevalent [11]. However, the demand for complex passwords to ensure security poses challenges in terms of memorability for users. Complex passwords, while more secure, are often difficult to remember, leading users to compromise security by writing them down or reusing passwords across multiple accounts [12]. In response to these challenges, graphical passwords have been suggested as a replacement form of authentication [13; 14; 15]. Graphical passwords leverage visual objects in the authentication process, capitalizing on the human ability to remember images more easily than alphanumeric data [16; 17]. Different methods have emerged, including recall-based methods, cued-recall-based methods, and recognition-based methods (RBMs) [8; 14; 18; 19; 20]. Recall-based methods involve reproducing a drawing, while cued-recall-based methods require selecting points on displayed images. RBMs necessitate distinguishing between registered and distractor objects and recognizing the pass-object [21]. Graphical passwords aim to address the challenge of memorability, surpassing alphanumeric passwords in terms of ease of remembering [17]. However, the convenience of graphical passwords also introduces risks, particularly from shoulder-surfing attacks (SSAs) [20]. Shoulder surfing (SS) involves unauthorized individuals observing and capturing authentication information while users enter their passwords, compromising the security of graphical passwords [22; 23]. To counter these threats, researchers have dedicated efforts to developing resistance methods, with recognition-based graphical passwords (RBGPs) being widely used to avoid SS assaults [24]. Nonetheless, despite numerous proposed methods, challenges persist in effectively countering SSAs. In light of the current related works on this topic, it is important to highlight the distinctive contributions and focus of this systematic literature review. While previous reviews [2; 14; 18; 21] have touched upon the resistance of RBGP methods to SSAs, there is still a lack of research relating to advancing existing methods for countering SSAs. For example, the review conducted in [2] only focused on graphical passwords developed in Korea throughout the year 2017. The survey conducted in [14] reviewed nine recognition-based systems developed between 2000 and 2004. [PERSON] et al. [18] evaluated and examined existing recognition-based systems up to 2016.