# Cyber Resilience and Incident Response in Smart Cities: A Systematic Literature Review
## 3 Results Analysis and Discussion
### Key Themes
#### 3.3.1 Chronological Analysis of Key Events  
The purpose of the chronological analysis is to examine the main determinants and the time correlation for the research distribution addressing CPS cyber resilience and modern DFIR in smart cities concerning the defined scope. To achieve this, the primary studies were organised in chronological order and classified depending on the year published and type of publication, as shown in Table 3. The trend shows that the first empirical study concerning this topic is dated from 2011 from a conference proceeding. It is not until 2016 that there is an 8% increase in research for this subject area through conference proceedings as the main outlet for the research publications. By 2017, the number of articles doubled and increased again in 2018. The differentiating factor was the high proportion of journal articles over publications from conference proceedings whilst by the first calendar quarter (Q1) of 2019 and the articles published in journals reached over 75% of studies published throughout the entire 2018. Further investigating the results from the chronological analysis, the following key years were highlighted as a potential influencing factor concerning the investigated CPS-related research developments: 2011, 2016, 2018. **2011. ** This year was defined by the Hannover Messe Fair, where the term \"Industry 4.0\" was born to describe the next industrial revolution, a vision of three German engineers. Whilst the first industrial revolution dates back to the end of the 18 th century introducing water and steam power, the second industrial revolution at the turn of the 20 th century was centred around mass production using electricity and the third industrial revolution integrated IT and electronics into production systems, the \begin{table}
\begin{tabular}{c c c} \hline \hline
**Keyword** & **Occurrence** & **In Studies** \\ \hline Attacks & 4165 & 50 \\ System(s) & 3650 & 52 \\ Security & 2272 & 51 \\ Internet of Things/IoT & 2024 & 36 \\ Model(s)(ing) & 2002 & 52 \\ Cyber-Physical Systems & 1857 & 52 \\ Smart & 1750 & 52 \\ Device(s) & 1610 & 50 \\ Detection & 1193 & 47 \\ Approach(es) & 589 & 50 \\ Method(s) & 579 & 49 \\ Analysis & 579 & 52 \\ Framework(s) & 491 & 44 \\ Technique(s) & 461 & 44 \\ Cyber \({}^{*}\) resilience/resilience & 251 & 26 \\ Processing & 242 & 38 \\ Architecture & 239 & 43 \\ Forensic(s) & 214 & 16 \\ Cyber \({}^{*}\) security & 179 & 37 \\ Response & 156 & 33 \\ Incident(s) & 41 & 15 \\ Prevention & 38 & 20 \\ Recovery & 32 & 10 \\ \hline \hline \end{tabular} The asterisk (*) in this table is used to represent the variants considered during the keyword search: space, dash or continuous word without any space i.e., ‘cyber resilience’, ‘cyber-resilience’, ‘cyberresilience’ and ‘cyber security’, ‘cyber-security’, ‘cyber-security’.  
\end{table} 
Table 4: Primary studies’ keyword analysis. 4 th industrial revolution introduces digital processing and implementation of the IoT into production. In this context, the concept and the vision have been established for CPSs for production systems. Industry 4.0, a German origin of the Industry 4.0 term, is used synonymously with cyber-physical production systems [1, 82]. In the post-recession output fall, the vision of Industry 4.0 elevated the German manufacturers and economy back into the spotlight [83, 84]. **2016. ** The creation of the UK's National Cyber Security Centre (NCSC) as the technical cybersecurity lead was a feature of this year. Furthermore, the investment and economic infrastructure plans announced in the National Infrastructure Delivery Plan in the UK [85] and the announcement of the significant cybersecurity fund as part of the USA's Cybersecurity National Action Plan also took place in 2016 [86]. The World Economic Forum (WEF) was also held in Davos. The WEF used the motto: \"Mastering the Fourth Industrial Revolution\" [87].