# A Systematic Review of Cyber Range Taxonomies: Trends, Gaps, and a Proposed Taxonomy
## 2 Materials and Methods
### Methodological Framework  
To address the research questions, we adopted a three-phase approach inspired by the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA 2020) [26] guidelines. Each phase was iterative, allowing insights and gaps identified in earlier phases to directly shape subsequent searches and analyses. The choice of PRISMA stemmed from its rigor and capacity to structure both quantitative and qualitative insights [27]. In Phase I, we searched for literature featuring either a novel taxonomy of cyber ranges or a systematic review that examined cyber range characteristics. Building on the findings of Phase I, Phase II focused the search on the literature discussing cyber range architectures, scenarios, and functions from 2019 onwards, thereby covering newly emerging considerations such as advanced technologies or novel applications. Phase III served as the verification stage, during which the refined taxonomy was tested against the Phase II literature to confirm its coverage, resolve any contradictions, and ensure consistency. Each phase informed the subsequent one, ensuring that newly identified gaps or inconsistencies from Phase I were critically re-examined in Phase II and then systematically verified in Phase III. This iterative design allowed for greater confidence in the final proposed taxonomy as it has been repeatedly tested and updated at each step.  
In developing our taxonomy, we relied on both an empirical inductive and a theoretical deductive approach. We began by examining existing taxonomies--observing empirical and factual cases to identify patterns. Through discussion and statistical techniques, we gathered the dimensions and characteristics agreed on by subject-matter experts and then reconciled any divergences that arose. Next, we drew on conceptual or theoretical foundations, guided by existing frameworks and the input of experts. In this step, we refined or modified the taxonomy derived in the inductive phase to ensure theoretical soundness. Combining these methods followed [PERSON]'s [10] three-level indicator model. It incorporated both \"empirical to deductive\" and \"deductive to empirical\" reasoning, ensuring that the final taxonomy remained grounded in real-world usage yet was also supported by established theory.  
To ensure that our taxonomy was both valid and practical [9; 10], we imposed two restrictions on every dimension:  
* Mutually exclusive: No single entity could have two different characteristics within the same dimension;
* Collectively exhaustive: Every entity needed to fit exactly one characteristic in each dimension.  
Beyond those restrictions, we focused on three guiding principles while conducting the research. Our taxonomy needed to be concise, including a manageable number of dimensions and characteristics. This was because overly complex schemes can exceed cognitive limits [9]. It needed to remain robust; each dimension needed to be sufficiently detailed to differentiate the entities of interest. A taxonomy with too few dimensions or characteristics risked failing to distinguish objects meaningfully. Finally, the taxonomy needed to be comprehensive, aiming for both empirical completeness--able to classify all known objects in the domain [28]--and conceptual completeness--including all dimensions relevant to the objects of interest, consistent with the idea that \"typologies must provide complete descriptions of each ideal type\" [28].  
Additionally, the taxonomy design was designed to be extensible, meaning that new dimensions or characteristics can be added as technology and research on cyber ranges evolve. As [PERSON] [10] notes, static taxonomies quickly become obsolete. Through explanations, we ensured that the taxonomy can help identify where an object belongs, even if not every property is fully known [9; 10].