# Cyber Resilience and Incident Response in Smart Cities: A Systematic Literature Review
## 4 Discussion
In addition to challenges accessing infrastructure-based simulators or testing in a production environment, there is a lack of publicly accessible datasets (Figure 11). The following study [18] stressed the need for access to public data to enable the successful adoption of technological innovations. To validate Industry-4.0-based proposals, the following study [2] relied on a combination of datasets. The limitation of the dataset used by reference [125] covering malicious IoT devices is the use of the CAIDA darknet datasets which predominantly contain malicious material. Based on the results, the research community appears to lean on software-based simulation using established platforms, predominantly Matlab [39; 101; 118; 132], but researchers also utilise UPPAAL [118] and ProModelProcess [39] simulators. Therefore, software-based simulations are a frequent choice to test experimental concepts. However, using software-based simulations may not be most suitable in some cases, for example, in smart mobility scenarios involving driving where reactions could be very different in a simulated environment knowing that a simulator can be restarted in a click of a button compared to a non-simulated experiment. This may have profound consequences to the required acceleration of research of cyber defence of CPSs within smart cities since there is reliance on simulators for sufficient presentation of threats compared to reliable decision making in a real-world environment. Concerning RQ1, during the primary studies' selection process, the researchers observed the availability of studies related to CPS applications. Within those studies, aspects of security may have been mentioned but they were not the focus of the study and often cyber defence was omitted altogether [18]. Moreover, although CPSs proliferate many aspects of modern lives and the demand and need for resilience in CPSs increases [151], the analysis revealed a distinct lack of available empirical research focused on the cyber resilience in the smart healthcare and smart citizen sectors (Figure 6). Possible reasons include the maturity of the Industry 4.0 technology compared with the smart sectors summarised in Figure 4[84, 85]. Moreover, the scale of media coverage of attacks on CNI like the cyberattack on the Ukrainian power grid [35] or Stuxnet [34] could also contribute to the prominence of the research in those sectors. Likewise, smart-healthcare- and smart-citizen-related research has complex and diverse ethical challenges including privacy and confidentiality concerns [145]. Infrastructure in smart cities consists of a growing number of highly integrated CPSs including traditional devices or entire cities retrofitted with new technologies to facilitate IoT connectivity [4, 7, 9]. Concerning RQ2, these devices contribute very little to support a systematic DFIR process in smart cities. Therefore, there is a need to develop a process-driven DFIR to deal with the evolving cyber threat landscape, the expanded attack surface and attack vector introduced through IoT connectivity [17, 28]. Furthermore, as the sources of evidence evolve, digital evidence is contained within the physical artefacts [44]. For example, image-based evidence can be gained through closed-circuit television (CCTV) surveillance or from social media. Behavioural anomaly detection can be used to detect unauthorised vehicle use through driver profiling [152], detect attacks on smart water systems [104] or unauthorised access within smart workplaces [24]. Digital evidence, similar to physical evidence, seized at a crime scene or following a security incident, is relevant during digital forensic investigations [67]. The majority of the primary studies have researched a subset of an IR process, predominantly focusing on the \"detection and analysis\" phase (Figure 10) of an incident utilising different approaches including profile detection, behavioural anomaly, system monitoring or audit analysis [47, 48, 65, 99, 100, 103, 104, 108, 120, 123, 124, 127].