# Cyber Resilience and Incident Response in Smart Cities: A Systematic Literature Review
## 3 Results Analysis and Discussion
### Key Themes
#### 3.3.3. DFIR Analysis
The results of the study placed the sub-factors identified as part of the smart security in the highest priority areas influenced by cybersecurity challenges which were identified as the \"surveillance and biometrics\" followed by \"simulation and modeling\" and \"intelligent threat detection\". Our results show that smart security sector studies do not have a specific focus on cyber resilience aspects, see Table 5. and research focus relates predominantly to the communication layer threats, see Figure 6. A security-by-design (SbD) approach was proposed by reference [48] articulated as a framework to develop a highly secure and trustworthy smart car service and protect them from cyberattacks. The authors argue ABA is a more suitable approach because of the sensors' low computational power and therefore a lack of encryption techniques applicability. The sensor profiling was accomplished by using the discrete wavelet transform (DWT) coefficients and the Euclidean distance was utilised for sensor classification. The presented results demonstrated an up to 95% accuracy for unknown and 98% for known attacks with a low false-positive rate. **Incident Detection and Analysis (IDA)** is a key phase in IR because the response cannot be manifested without accurate detection. Although incident detection is considered a reactive approach, there are detectable events that precede an incident. The results from the primary studies show that the highest distribution in the detection and analysis stage of the IR model is in the smart infrastructure sector as shown in Figure 9, and overall 67% of the sampled primary studies focus exclusively on cyberattacks detection, as shown in Figure 10. The author in reference [107] presents a framework for smart homes and smart buildings addressing multiple layers and threat types. The study utilised ABA-IDS to continuously monitor, detect and classify cyberattacks against sensors with high accuracy. The study aimed to extend the methodology to other IoT security frameworks, such as smart water systems [104] and smart grid systems [108]. Both studies rely on ABA-IDS utilising JRip classification algorithm achieving up to 99.8% and 97.18% accuracy on their respective datasets. The ABA-IDS detection and the classification results for reference [107] were similar and in some instances exceeded the results of other state-of-the-art protection systems for smart grids. Different approaches were proposed to enhance the detection of cyberattacks in industrial control systems. For example, a secure water treatment plant often consists of distributed cyber infrastructures that control physical processes \begin{table}
\begin{tabular}{c c} \hline \hline
**Key Stage** & **Primary Studies** \\ \hline Preparation & [13,48,100,111] \\ Detection and Analysis & [2,33,36,37,38,39,40,51,63,64,65,67,99,105,107,111,113,115,116,117,118,119,122,126, \\ Containment, Eradication and Recovery & 128,129,131,133,137,142] \\ Post-Incident Activities & [40,49,52,100,103,104,107,114,121,127,129,130,133,135] \\  & none \\ \hline \hline \end{tabular}
\end{table} 
Table 8: DFIR key stages categorisation of primary studies. The author in reference [118] proposed a time automata (TA) approach, whilst another study [64] focused on a hybrid of machine learning combined with a specification-based detection. An orthogonal defence mechanism consisting of several intelligent checkers was used by the author in reference [51]. **Containment, Eradication and Recovery (CER)** is the part of the process where models and standards differ. Whilst NIST views the CER as a single step, SANS (SysAdmin, Audit, Network, and Security), DFRWS and ISO/IEC 27050-3:2017 view them as separate segments. Furthermore, the terminology used by different frameworks and standards to identify similar steps can vary. The terminology used by NIST 800-61 refers to containment as an aim to stop the attack or threat, eradication removes it stopping cross-systems proliferation and recovery aims to get the system operation returning to business as usual.