## 3 Methodology
### Document Search Framework  
Figure 1 demonstrates the document search framework using a funnel approach during this research, gradually reducing an initial collection of 9813 documents to the  
Figure 1: Document search framework.  
final 3712 counts. The main objective is to collect a complete group of high-quality articles that will later be analysed. Each phase includes a description that explores technological structures, system component assembly, and motivational design factors.  
Multiple inclusion and exclusion criteria were applied to reduce the final number of articles to 3712. The first process includes using Scopus with specific keywords inserted across abstracts and keywords while including terms in the title field. This approach reaches maximum study representation while creating an inclusive final dataset. The constructed search queries aim to retrieve research themes and relevant terminology encompassing our research objectives.  
In the second phase, non-relevant publications were eliminated through title-based criteria. After that, conference proceedings, reports, thesis, book chapters, preprints, and books were removed while selecting original research and review articles that achieved formal peer review. Our quality standards determine this criterion to ensure the quality and reliability, which confirms that our analysis targets only peer-reviewed scholarly publications.  
The analysis moves to \"in press\" articles for removal because their content and citation information will likely change before becoming final publications. Our analysis relies on only complete articles because this approach reduces potential issues from temporary or developing information in preliminary texts.  
The procedure ends with the removal of articles that are not written in English. Our specialised analytical apparatus operates best on English-language content, so this sorting process enhances the following analysis operations. An integrity assessment verifies that the database contains only records that contain complete metadata information and operational DOIs.  
This resulted in 3712 records, and we continued to analyse these final documents. For scientometrics analysis, this study used VOSviewer, a powerful tool for analysing bibliometric networks, to visualise the data extracted from Scopus for this study [49]. VOSviewer was used to map author co-authorship networks, country co-authorship networks, and research cluster network maps by keyword co-occurrences. The generated network maps facilitated identifying emerging trends in ML and cybersecurity, influential authors, countries and institutions, and key research areas. This tool works exceptionally well for mapping the connections between different research topics, offering a magnificent view of the development of ML and DL in cybersecurity.  
Moreover, VOSviewer was used because it can perform network visualisation, user-friendliness, and co-occurrence analysis. Additionally, VOSviewer was suitable for our study objectives because it could map the keyword co-occurrence and citation analysis.  
This study focuses on one tool instead of many simultaneously, avoiding the complexity of integrating multiple software platforms and making the results comparable and the visualisation clear. The generation of easy-to-understand bibliometric maps by VOSviewer makes it a powerful resource for conducting this scientometric review. This study offers a holistic overview of AI, ML, and DL research trends in cybersecurity through this methodology, exploring how these technologies have been used, the challenges encountered, and the future of this field. This research is meant to guide future research and deepen the understanding of AI, ML and DL's role in cybersecurity practices.