## 3 Results
### RQ5--What Technological Tools Have Been Used to Implement These Proposals?
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Category of Tools** & \multicolumn{3}{c}{**Tools and Studies Which Applied Them**} \\ \hline \multirow{3}{*}{Programming languages} & **Python:** S1, S2, S3, S4, S5, S6, S7, S8, S9, S10, S11, S12, S13, S14, S15, S16, S17, S18, \\  & S19, S20, S21, S24, S26, S27, S28, S29, S30, S31, S32, S33, S34, S35, S36, S37, S38, S39, \\  & & S40, S41, S42, S43, S44, S45, S23; **Java:** S25; **Matlab:** S22 \\ \hline \multirow{3}{*}{Frameworks} & **TensorFlow:** S1, S3, S5, S8, S9, S10, S11, S12, S13, S19, S20, S21, S23, S24, S27, S28, \\  & S29, S31, S32, S33, S34, S35, S36, S37, S43, S44, S45; **Keras:** S1, S3, S4, S5, S6, S10, \\  & S11, S13, S19, S21, S23, S24, S25, S27, S41; **PyTorch:** S11, S44; **Scikit-learn:** S3, S4, S5, \\  & S11, S12, S13, S16, S18, S19, S21 \\ \hline \multirow{3}{*}{Hardware} & **GPU:** S1, S3, S5, S10, S19, S42, S35; **CPU:** S3, S4, S5, S13, S35; **Raspberry Pi:** S14, \\  & S18, S26; **Intel Core i7:** S3, S16, S21, S23, S33; **Intel Core i5:** S4, S23, S41, S44; \\  & **Raspberry Pi:** S14, S18, S26; **NVIDIA:** S10, S39, S42, S45, S23; **Cloud based server:** \\  & S23, S44; **Google Collaboratory:** S18 \\ \hline \multirow{3}{*}{Complementary tools} & **Numpy** (S4, S11, S29); **Pandas** (S4, S11, S12); **Scikit-learn** (S3, S4); **Wireshark** (S10, S16, S40); **tcpdump** (S6, S14); **Roboflow** (S13); **SHAP, LIME, RuleFit** (S30); **SMOTE** (S21, S34); **Flask** (S26); **GridSearchCV** (S19); **Zeek/Bro IDS** (S18); **BoT-IoT dataset** (S7); **SUMO** (S44); **Autoencoder** (S36); **FastText** (S38); **OpenCV, Matplotlib** (S45); **PyCharm** (CE); **OpenCV** (S13, S29); **Dask** (S19) \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Software and hardware used to implement the analyzed proposals. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Statistics** & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **F1-Score (\%)** \\ \hline Studies that use metric & 39.00 & 33.00 & 32.00 & 31.00 \\ Mean & 97.44 & 96.13 & 96.06 & 96.00 \\ Standard deviation & 4.13 & 6.09 & 6.09 & 6.08 \\ Min value & 82.26 & 77.60 & 78.90 & 75.80 \\
25\% & 97.13 & 96.91 & 96.89 & 96.29 \\
50\% & 99.28 & 98.90 & 98.60 & 98.63 \\
75\% & 99.74 & 99.54 & 99.44 & 99.29 \\ Max value & 100.00 & 100.00 & 100.00 & 100.00 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Summary statistics of model metrics in analyzed studies. in detecting threats with high precision. Furthermore, 28 studies surpass the mean accuracy (S1, S2, S3, S6, S7, S9, S11, S12, S13, S14, S15, S16, S17, S18, S19, S21, S22, S24, S25, S27, S28, S32, S34, S35, S36, S38, S41, S43). On the other hand, models with the lowest accuracy, such as S4 (85.10%), S42 (82.26%), and S30 (88%), suggest that the techniques employed in these studies may not be sufficiently robust to detect certain attack patterns. Similarly, precision (ability to avoid false positives; see Figure 6b) measures the proportion of positive predictions that were actually correct, helping to minimize false positives. The mean precision is approximately 96.13%, which indicates that most models successfully avoid misclassifying benign events as threats or violent actions. However, the standard deviation is higher (6.09), reflecting a greater variability among models. The studies with the highest precision are S19, S136, S43 (100%), S11 (99.91%), and S8 (99.90%), demonstrating the effectiveness of DNN-, CNN-, and XGBoost-based approaches in achieving an excellent balance in threat identification while minimizing excessive false positives. Moreover, 24 studies exceed the mean precision (S2, S3, S7, S8, S11, S12, S13 S15, S16, S17, S18, S19, S21, S22, S24, S25, S27, S28, S32, S33, S34, S36, S38, S43). Conversely, studies such as S42 (77.60%), S10 (81%), and S4 (84%) exhibit low precision, implying a higher false alarm rate and a potential lack of discrimination in classifying actual threats.