# A Systematic Review of Cyber Range Taxonomies: Trends, Gaps, and a Proposed Taxonomy
## 3 Proposed Taxonomy
### Environment
In our taxonomy, we retained _Learning_ as a distinct and clearly defined dimension to emphasize its pedagogical importance in cyber ranges. We identified four main characteristics, as shown in Table 8.  
Monitoring  
_Monitoring_ spans through the entire lifecycle of a cyber range, tracking system performance, memory usage, logs, and participant activity. While some authors referred to related terms such as _Data Collection_[13] or _Competency Management_, these were typically sub-functions of monitoring in practice. Data collection refers to extracting artifacts such as logs or memory dumps, while competency management tracks participant performance and scoring. While partly a learning function, it also relies heavily on monitoring data. In cases where papers divided monitoring tasks more granularly, we consolidated them into a single _Monitoring_ dimension to avoid redundancy. This dimension was extensively covered in the literature, with over 80 references linking it to cyber range implementations. We organized _Monitoring_ into six main characteristics, described in Table 9. \begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Characteristic** & **Sub-Characteristic** & **Description** & **Refs** \\ \hline After-Action Analysis & — & Structured post-exercise review of participant activity, often tied to debriefing and performance evaluation. & [11; 54; 65; 11] \\ \hline Tutoring & — & Educational support including documents, interactive hints, and training portals to scaffold participant learning. & [66] \\ \hline Scoring & Type, Method & Performance evaluation based on impacts to Confidentiality, Integrity, and Availability. May include live or dynamic scoring dashboards. Scoring systems often implied but rarely defined. Existing models include penalty-based and mathematical evaluations. Represents a gap in the current literature. & [57; 60; 67] \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Characteristics of _Learning_ dimension. \begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Characteristic** & **Sub-Characteristic** & **Description** & **Refs** \\ \hline Method & — & Describes how systems or participants are monitored, including event-driven alerts, system resource tracking, and file system changes. Event-based, CPU, Filesystem & [68; 69] \\ \hline Dashboard & — & Interfaces used to visualize metrics like attack indicators, participant scores, and resource usage. Kibana, Custom UI. & [31; 70] \\ \hline Layer & — & Specifies the layer of the system or user activity being monitored, from low-level infrastructure to social/behavioral layers, fx. Network, Application, Hardware, Social. & [11] \\ \hline Performance & — & Includes monitoring of CPU/memory performance and user progress or behaviors within the scenario. & [71; 72] \\ \hline Progress & Actions, Inputs, Path, Teams, Users & Tracks participants’ journey through exercises, including their discrete actions, inputs, decision paths, team dynamics, and scoring. & [59; 73] \\ \hline Tools & — & Frameworks such as OpenStack’s dashboard and the EK stack to custom-built solutions. Some implementations rely on bespoke components designed to capture data from complex system interactions. & [74] \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Characteristics of _Monitoring_ dimension. While _Teams_ was included here as a sub-characteristic of _Progress_, to reflect tracked group performance, the broader _Teaming_ dimension referred to role structure and exercise objectives, not monitoring outputs. Management  
_Management_ is a core component in most cyber range taxonomies, overseeing the system's operation across its entire lifecycle. This includes responsibilities such as resource handling, user roles, and scenario orchestration. In our framework, we merged two frequently mentioned but overlapping dimensions--_User Interface/API Gateway_ and _Orchestration_--under the broader umbrella of _Management_. [PERSON] et al. [PERSON] et al.