# A Systematic Review of Cyber Range Taxonomies: Trends, Gaps, and a Proposed Taxonomy
## 1 Connection Technologies  
Technologies such as VPN, TCP/IP, and peer-to-peer (P2P) links enable secure communication between components and serve as foundational infrastructure for both stand-alone and federated cyber ranges. * **Virtualization Layer*
* This characteristic encompasses the different methods used to simulate or emulate computing environments [4; 84]. We distinguished between _Traditional Virtual Machines_ (VMs), _Containerization_, and Cloud _Virtualization_ (including public, private, and hybrid models):
* **Cloud Virtualization:*
* Uses public or private cloud platforms (e.g., AWS, Azure) to provide virtual machines, storage, and network resources on demand [93; 100]. * **Hybrid Cloud:*
* Combines the scalability of public infrastructure with the control and security constraints of a private cloud [35]. * Employs tools such as Docker and Kubernetes to create lightweight, rapidly deployable environments suitable for high-tempo training scenarios [62; 94; 97]. * **On-Premise Virtualization:*
* Some cyber ranges are hosted entirely on internal hardware, typically in military or critical-infrastructure contexts, where maximum control is required [92; 99]. * **Traditional Virtualization:*
* Involves hypervisor-based virtual machines that allow multiple isolated operating systems to run concurrently on a single physical machine [79]. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Characteristic** & **Sub-Characteristic** & **Description** & **Refs** \\ \hline Connection Technologies & — & Secure data links between cyber range components (e.g., VPN tunnels, encrypted TCP/IP stacks, peer-to-peer meshes). & [92] \\ \hline Virtualization Layer & Virtual Machines & Hypervisor-based VMs that isolate multiple OS instances on shared hardware. & [93] \\ \cline{2-4}  & Containerization & OS-level virtualization such as Docker or LXC enabling rapid, lightweight instantiation. & [94] \\ \cline{2-4}  & Cloud Virtualization & Public, private, or hybrid IaaS provisioning on platforms like AWS or Azure; includes SaaS access to pre-built ranges. & [93; 94] \\ \hline System Architecture & Monolithic & All services deployed as a single unit—suitable for small deployments but less scalable. & [95] \\ \cline{2-4}  & Microservice & Disaggregated services offering elasticity at the cost of orchestration overhead. & [95] \\ \cline{2-4}  & Federation & Linking geo-distributed ranges via VPN or SD-WAN for joint exercises. & [92] \\ \hline Artificial Intelligence & ML/DL & Machine and deep learning pipelines for threat detection and digital twin generation. & [96] \\ \cline{2-4}  & Large Language Models & Emerging use of LLMs for log summarization and scenario narration. & [62] \\ \hline Tools & Security & Offensive/defensive toolsets such as IDS (Snort), DPI modules, and honeypots. & [97] \\ \cline{2-4}  & Monitoring & Telemetry and scoring frameworks (Zeek, ELK, Grafana) providing runtime visibility. & [94] \\ \cline{2-4}  & Orchestration & Infrastructure-as-Code and lifecycle-automation frameworks (TOSCA, CRACK, Kubernetes). & [98] \\ \hline Database & — & Persistent or in-memory stores for scenario artifacts and telemetry (relational, document, vector, Redis). & [99] \\ \hline \hline \end{tabular}
\end{table} 
Table 11: Characteristics of Technology dimension. * **SaaS Integration:** Software-as-a-Service solutions enable access to pre-configured training environments without requiring extensive local setup [79; 101]. * **3. System Architecture** This characteristic reflects how the components of a cyber range are structurally organized. Across the literature, three primary architectural models were discussed: _Monolithic_, _Microservice_-based, and _Federation_-based:
* **Federation:** Federation serves both as an architectural style and a technical configuration. In the context of cyber ranges, it typically involves linking multiple geographically or organizationally distinct systems. [PERSON] et al.