# Security Risk Analysis in IoT Systems through Factor Identification over IoT Devices
## 3 Materials and Methods
### Research Clarification  
Systematic Literature Review  
**Phase 1. Selection of studies**  
The selection of studies was based on a systematic review following the PRISMA guidelines [21]. The following databases were used: Springer, Scopus, IEEE, Association for Computing Machinery (ACM), Web of Science, and Science Direct. These databases were chosen because they are the most relevant sources of information for Computer Science. The range of publications spans from 2016 to 2021. **Inclusion and exclusion criteria**  
The inclusion criteria were: (i) manuscripts published by peer-reviewed academic sources; and (ii) manuscripts that analyzed factors enabling security attacks on IoT systems. The exclusion criteria included: (i) manuscripts that, despite including technical aspects, did not detail the factors enabling the security attack; and (ii) manuscripts that addressed proposed risk analysis methodologies to avoid subjectivities. The following research strings used were:  
\"(IoT OR Internet of thing)\" AND \"(Security attacks OR cybersecurity attacks)\"  
\"(IoT OR Internet of thing)\" AND \"(Security risk OR cybersecurity risk)\"  
\"(IoT OR Internet of things)\" AND \"(Threats OR vulnerabilities)\"  
From the search string, we found 1607 articles. Table 2 shows the searched articles distributed in: conferences, journals, series, chapters and books. Figure 1: Phases of Design Research Methodology (DRM) to development risk analysis methodology for IoT systems. Duplicate manuscripts were eliminated through a manual review of the collected articles. During this process, 23 duplicates were eliminated. **Phase 2. Screening**  
The screening process was based on a review of article titles and abstracts using the Rayyan web application (Rayyan), created for the systematic review process by MIT. The web application allows each reviewer to view the titles and abstracts of the articles collected while maintaining a blinded review process. Articles that did not meet the inclusion criteria in the title or abstract were excluded at this stage of the study. A screenshot of the process carried out in the Rayyan tool is shown in Figure 2.  
**Phase 3. Eligibility analysis**  
A full text review of each of the 370 articles was conducted to determine those with more detail related to the factors during IoT security attacks. After this process, 55 articles were selected for the data mining process. A flowchart of the PRISMA process is presented in Figure 3.  
**Phase 4. Inclusion**  
**Data extraction**  
For this stage, we developed a qualitative analysis of the 55 documents from the eligibility analysis phase using ATLAS TI version 9. During the qualitative analysis, 11 codes were defined in the Atlas TI associated with factor: **application domain**, related to the verticals in which IoT systems have been implemented [22; 23; 24]; **attack surface**, related to the entry and exit points via which attacks can be performed [25]; **interdependency**, related to the relationship of the IoT system with other IT/OT/IoT systems that could increase the severity of the attack [26]; **scalability**, related to the coverage area that can be affected by the propagation of the attack [27]; **severity**, related to the value of the damage that can be caused by the attack [28]; **susceptibility**, related to the predisposition to pick up the effects of an attack [29]; **type of attack**, related to the attack vector, technique or methodology [30; 31]; **device type**, related to the type of IoT device [32; 33]; **type of information**, related to the type of information processed, stored, or transmitted by the \begin{table}
\begin{tabular}{c c} \hline \hline
**Label for Hypothesis** & **Factors** \\ \hline Conferences & 807 \\ \hline Journal article & 559 \\ \hline Series & 215 \\ \hline Chapter & 23 \\ \hline Book & 3 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Publication types of articles according to inclusion and exclusion criteria.