# A Systematic Review of Cyber Range Taxonomies: Trends, Gaps, and a Proposed Taxonomy
## 1 Connection Technologies
### Phase III--Proposed Taxonomy  
The third phase served as both verification and finalization, applying the refined taxonomy to all previously included papers to confirm coverage and the mutual exclusivity of each dimension. Building on the baseline taxonomy established in Phase I and refined in Phase II, the third and final phase of our research (Phase III) thereby sought to verify a final updated taxonomy. The second refinement cycle resolved most structural inconsistencies identified during the initial mapping of sources; Table 11 summarizes the _Technology_ dimension as retained at the end of Phase II. Phase III consolidated and removed superfluous characteristics, as detailed below in Table 12. The proposed taxonomy presented in this chapter therefore pursued a final round of simplification and abstraction, guided by three design criteria:  
1. **Conceptual necessity:** A characteristic was retained only if it captured variability demonstrably discussed in the literature.
2. **Non-redundancy:** Overlap between dimensions was eliminated wherever possible.
3. **Longevity:** Items that risked rapid obsolescence (e.g., specific operating systems) were omitted in favor of higher-level abstractions.  
relies on basic network protocols such as TCP/IP or VPN tunneling. Their explicit inclusion therefore violated the non-redundancy criterion.  
All software artifacts deployable within a cyber range--whether for orchestration, monitoring, or protection--were now housed under a single characteristic, _Tools_. This merger removed the prior duplication between the _Monitoring_, _Management_, and _Technology_ dimensions and foregrounded the commonality of such artifacts as installable, configurable components.  
The earlier distinction between \"conventional\" and \"traditional\" virtualization was also removed. Instead, the final taxonomy now differentiated between three virtualization approaches: _Traditional Virtual Machines_, which rely on hypervisor-based architectures; _Containerization_, exemplified by tools such as Docker, LXC, and Kata; and _Cloud Virtualization_, which refers to deployment on public, private, or hybrid cloud infrastructures.  
Our Phase III literature review showed that the monolithic vs. microservice distinction seldom influenced cyber range design decisions in isolation; they were, rather, manifestations of broader engineering practices. Consequently, the _Architecture_ characteristic was removed. Federation, however, was retained--now directly under _Technology_--because it governed cross-site resource pooling and latency management and was explicitly discussed in the literature.  
To conclude the results of our three-phase systematic review of 206 studies published between 2014 and 2024, we synthesized a seven-dimension taxonomy: _Scenario_, _Environment_, _Teaming_, _Learning_, _Monitoring_, _Management_, and _Technology_, as shown in Figure 5.  
Figure 5: Proposed taxonomy (Phase III) with the seven retained dimensions: _Scenario_, _Environment_, _Teaming_, _Learning_, _Monitoring_, _Management_, and _Technology_, together with every characteristic and sub–characteristic consolidated in Phase III.