# Optimizing Internet of Things Honeypots with Machine Learning: A Review
## 4 Methodology
### Data Collection  
For the collection of relevant literature, the authors employed a systematic and structured approach, adhering to best practices and guidelines from [PERSON] et al. [24]. The first step in the data collection process was to define key search terms to ensure that all relevant literature on IoT honeypots and machine learning techniques were included. The authors defined the core search terms as \"honeypot\", \"IoT\" and \"Internet of Things\". These terms reflect the primary focus of this research work on the development of honeypots within the IoT domain. Given that these terms are quite broad, they were combined using the logical operator \"AND\" and \"OR\" to increase the relevance of the search results. The precise search string used across all databases was:  
(\"iot\" OR \"internet of things\") AND \"honeypot\"  
This search string allowed us to retrieve literature directly related to IoT honeypots as well as those exploring other cyber security and machine learning concepts in this domain. The authors selected four key databases for the literature search: Scopus, IEEE Xplore, ACM, and DTU Find. The authors chose these databases because of their broad and interdisciplinary coverage, making them well-suited for accessing a wide range of research articles in the relevant fields. Scopus was chosen for its extensive coverage of interdisciplinary scientific publications. It is particularly strong in computer science and applied engineering, making it an excellent source for conference papers and journal articles relevant to our paper. ACM Digital Library and IEEE Xplore are renowned for their focus on computer science and engineering, containing numerous publications on security architectures and machine learning techniques within the context of cybersecurity. DTU Find provides access to technical and engineering-focused research, including literature on advanced IoT technologies, which aligns well with the research objectives of this research work. The literature research was conducted in October 2024. Therefore, the search includes all results from the latest developments in the field of machine learning for IoT honeypots up to and including this period. The results from these three databases are summarized in Table 2, which shows the number of hits per database. The search results are presented in terms of the number of hits, which reflects the total number of articles retrieved from each database. Initially, 40 relevant articles were identified based on the defined search terms, forming the basis for the subsequent steps of the literature review process followed by this research work. To ensure the thoroughness of this review, the authors established inclusion and exclusion criteria, drawing upon the guidelines provided by [PERSON] et al. [8]. These criteria were designed to ensure that only high-quality and relevant literature was included in our analysis. The inclusion criteria included studies, conference papers, and technical reports that addressed machine learning techniques in IoT honeypots or related security mechanisms. The authors also focused on literature that provided detailed descriptions of methods, experiments, or technologies used, as this was essential for data analysis of this research work. The exclusion criteria were as follows:  
1. Literature that did not address honeypots or was unrelated to IoT. 2. Literature that lacked insights into machine learning techniques. 3. Literature that focused narrowly on technologies outside the scope of our research. 4. Literature that only focused on the hardware aspects of honeypots and did not incorporate machine learning. Following these selection criteria, the authors initially identified 40 relevant articles, which were then used as the foundation for the snowballing process. This process, as described by [PERSON] et al. [8], was employed to identify additional relevant literature by reviewing the reference lists of the selected articles. The snowballing process was carried out in two phases: backward and the forward snowballing.