Document Overview
This is a review article published by MDPI on 13 August 2020 (34 pages). The metadata lists Carsten Maple as author. The text names affiliations at the University of Wolverhampton (Wolverhampton Cyber Research Institute) and the University of Warwick (Warwick Manufacturing Group). Its subject is cyber resilience and digital forensic incident response (DFIR) in cyber-physical systems (CPSs) within smart cities.
Aims and Research Questions
The paper presents a systematic literature review (SLR) that consolidates empirical evidence on existing frameworks and systems addressing CPS cyber resilience in smart cities. It poses three research questions: how such frameworks support cyber resilience (RQ1), how they address modern DFIR (RQ2), and which cross-sector proposals in smart cities use CPS interactions to improve DFIR (RQ3).
Methodology
The authors followed the SLR guidelines of Kitchenham and Charters, organised in planning, conducting and reporting phases. The search covered five digital libraries (IEEE, ACM DL, ScienceDirect, Web of Knowledge and Scopus) and concluded on 5 April 2019. Keyword filtering returned 441 studies, and title and abstract screening left 122. After full-text filtering and snowballing, 52 primary studies were included. The text reports that 600 papers were surveyed in total. Quality assessment covered CPS focus, context, framework detail and data, and 30 random studies were re-checked at each of two validation stages.
Publication Trends and Study Types
The document reports that no primary studies were published before 2011 and that output rose over time, with journal articles exceeding 75% of the studies from 2018 published in the first quarter of 2019. Non-empirical studies, including surveys, made up 64% of the reviewed sample, against 36% empirical studies. The authors link the growth to events such as the 2011 introduction of the term Industry 4.0 and cybersecurity strategies from 2016 and 2018.
Key Findings on Resilience and DFIR
According to the review, 46% of primary studies considered the communication layer, while only 5% covered all three layers (physical, communication and application). Nineteen per cent addressed both internal and external threats, and 45% did not clarify the threat type. Detection-focused work dominated: 67% of studies focused exclusively on cyberattack detection, only 13% investigated containment, eradication and recovery, and post-incident activity was not addressed by any primary study.
Data Sources, Sectors and Geography
Most experiments relied on software-based simulations (46%) or simulation infrastructure (42%), while 12% of studies published between 2018 and early 2019 used public datasets. Smart infrastructure, smart mobility and smart security were the most addressed sectors, while smart healthcare and smart citizen received few studies. By authorship, the USA accounted for 23% of contributions, followed by Singapore (10%), the UK (8%) and Australia (7%). By continent, Asia led at 37%, then Europe at 30% and North America at 26%.
Why It Matters for Smart City Cyber Defence Research
The document states that its purpose is to present scientific evidence of gaps in current research and to guide future research directions. It recommends that future work integrate cyber threat intelligence (CTI) into incident response, address the scarcity of publicly accessible real CPS-generated datasets, and extend research into smart healthcare and smart citizen sectors. It is addressed to researchers working on cyber defence in smart cities.