## 4 Discussions  
### Future Research Directions  
As outlined in this paper, the majority of novel contributions to the literature surrounding cyber security over the last three years can be categorized into one of four primary research fields. These are broadly considered as cybercrime, data security, machine learning for intrusion detection, and datasets and models. Conversely, most novel contributions to the literature surrounding CPS over the last three years can be broadly categorized into one of four research fields; simulation and modeling, cyber security, cyber defense, and applications to meet field specific niches. Through this review, several research gaps and opportunities were identified and synthesized relating to cyber security and cyber-physical systems. Through the cyber security lens, these relate to human-cyber dynamics, the need to decouple intent from threat, and vulnerability in machine learning. From a CPS perspective, these relate to robustness in CPS design, limited case diversity, and consideration of human factors. Together the research gaps in these two areas form an opportunity for future novel research design at the intersection of cyber security and cyber-physical systems. Recent novel research often focused exclusively on technological advancements to cyber security such as blockchain, machine learning, and encryption, rather than considering a system-of-systems approach where humans play a pivotal role in the cyber security of those systems. Whilst there was limited discussion of the role of people in cyber security, one study highlighted how the embedded nature of the internet and mobile devices has the potential to increase the risk of cyber-attacks [36]. The concept of cyber-social relationships were also discussed in the recent novel literature, relating to attitudes surrounding cybercrime reporting [18]. Only one reviewed study addressed the role that people's attitudes and behaviors play in influencing cyber security behaviors [36]. This was an outlier within the cyber security literature, where most studies focused on technology-centric solutions to security problems. Values regarding cyber security are often linked to human requirements within the system design process, such as the CIA triad of confidentiality, availability, and integrity [60, 61]. Without people considered within the system, these concepts can degrade in value. For example, the importance of confidentiality of medical data is lowered if there are no providers interacting with the system. Subsequently, building systems with cyber security in mind also implies the need to build systems with humans in mind. This is contrasted to the most recent novel literature surveyed, which focused primarily on a range of technological challenges relating to cyber security. Whilst these developments are essential, ignoring the role that people play has the potential to leave security vulnerabilities open that cannot be exclusively addressed by technological solutions. A common theme within the recent novel research of cyber security was that of intentional cyber threats. Research focused on things such as cybercrime, intrusion detection, and privacy. These focal areas rely on an interpretation of threat as being intentional by another entity within the system, such as a person accessing data they are not authorized to or breaching a system's defenses. This leaves a potential research gap regarding unintentional threats to cyber security. These may come from human origins, such as ignorance as shown in [PERSON] et al. 's research, or from cyber sources, such as the input of unexpected data structures from sensor or the data rates that exceed processing resources [36]. Within this problem set, there is also a potential research area that could look at how complex system behaviors in cyber systems, such as normalized deviance from baselines due to nonlinearity or event emergence, may have unintentional security outcomes.