# A Systematic Review of Cyber Range Taxonomies: Trends, Gaps, and a Proposed Taxonomy
## 3 Proposed Taxonomy
### Phase I: Taxonomy Reviews, Systematic Literature Reviews, and Baseline Taxonomy
#### 3.1.1 Taxonomy Reviews  
This section describes the key works that primarily proposed a cyber range taxonomy. Although some papers also had review elements, we classified them here because their central outcome was a taxonomy or framework for organizing cyber range elements. [PERSON] et al. 's [11] paper, _Cyber Ranges and Security Testbeds: Scenarios, Functions, Tools and Architecture_, was one of the earliest comprehensive taxonomies we identified. The authors analyzed works from 2002 to 2018, focusing on both cyber ranges and cybersecurity testbeds (e.g., IoT, cyber-physical systems (CPSs), and SCADA). They initially presented a baseline taxonomy with five dimensions--_Monitoring_, _Scoring_, _Management_, _Teaming_, and _Scenario_--but eventually concluded that _Environment_ observed to be promoted from a characteristic to a stand-alone dimension, given its critical role in shaping cyber ranges' functionalities. They also created a new dimension called _Learning_, placing _Scoring_ under it as a characteristic. The final taxonomy by [PERSON] et al. [11] had these dimensions:  
* **Scenario**: Describes the life-cycle of the cybersecurity scenario (creation, generation, editing, and execution). * **Monitoring**: Covers the methods, dashboards, and tools used to track cyber range data or overall system health. * **Learning**: Defines how a cyber range supports tutoring and after-action analysis (including scoring). * **Management**: Concerns range management roles, interfaces, command and control, etc. * **Teaming**: Describes different teams (e.g., Red, Blue) that might participate in an exercise. * **Environment**: Focuses on the type of environment (e.g., physical, virtual) in which a cyber range is run, along with any event-generation tools. As this paper combined cyber ranges and testbeds in a single taxonomy, much of the subsequent research built upon or refined this foundational work. [PERSON] et al. 's [12] paper, _A Review of Cyber-Ranges and Test-Beds: Current and Future Trends_, was another foundational taxonomy found in our review. It covered studies from 2015 to 2020, arguing that the surge in recent publications may have affected [PERSON] et al. 's [11] earlier taxonomy. [PERSON] et al. 's [12] taxonomy was more granular, but it aligned with the work of [PERSON] et al. [11] on many core ideas. Key modifications included the following:  
* **Type**: Elevated to a dimension ([PERSON] et al. [11] treated it as a characteristic of _Environment_). * **Econometrics**: Added as a new dimension, focusing on the economic consequences of participant actions (e.g., cost impacts during scenarios). * **Recovery**: Introduced as its own dimension, ensuring that policies, patches, and post-incident measures were up to date. * **Testbeds**: Added as a distinct dimension, effectively creating a mini-taxonomy within the broader taxonomy to capture how testbeds fit into a cyber range. [PERSON] et al. 's [30] paper, _Cyber Taxi: A Taxonomy of Interactive Cyber Training and Education Systems_, took a different route. Rather than a systematic review, it relied heavily on the authors' practical experiences, summarized by the following quote: \"Theoretical knowledge is good, practical proficiency is better.\" ([30] p. 2). While they acknowledged [PERSON] et al. 's [11] taxonomy, they argued that it lacked audience-specific considerations such as target audience, proficiency level, and scoring. Despite its different origin, [PERSON] et al. 's [30] final taxonomy resembled the earlier ones, but highlighted the following:  
* **Audience**: Split into _Sector_, _Purpose_, _Proficiency Level_, and _Target Audience_. * **Training Environment**: Defined the type of cybersecurity training. This was where _Scenario_ was categorized, contrasting with its dimension status in the work of [PERSON] et al. [11] and [PERSON] et al. [12]. [PERSON] et al. 's [13] paper, _Enabling Next-Generation Cyber Ranges with Mobile Security Components_, addressed the lack of realistic mobile-device support in most cyber ranges.