Broad interest
Artificial intelligence in cybersecurity.
Stage 1 / Worked Example
STAGE 1 · DISCOVER · COMPUTING EXAMPLE
From a broad idea to a documented search plan
Follow one illustrative topic through the seven Stage 1 steps. The topic, concepts and search string below are teaching examples, not a validated protocol or a report of database search results.
Use this as a model for decisions, not as a copy-and-submit answer. Replace it with your own research question, justify your database choices, test the search, and enter actual dates and result counts from the interfaces you use.
STEP 01
Topic & Scope
Focused direction
Explainable AI techniques used for intrusion detection in Internet of Things networks.
Working title
Explainable AI for Intrusion Detection in Internet of Things Networks: A Systematic Literature Review
Boundary decisions to make
- Which forms of IoT or networked systems are in scope?
- Which intrusion or anomaly detection tasks will be included?
- Will the review include only empirical evaluations, or other study designs too?
Do not state that the topic is novel because an AI tool suggests it. Check prior reviews in suitable databases and record what you searched.
STEP 02
Research Questions
Example questions should follow from the scope and be answerable from the studies you plan to find.
- RQ1. What explainable AI techniques have been used for intrusion detection in Internet of Things networks?
- RQ2. How have detection effectiveness and explanation quality been evaluated in these studies?
| Question focus | Concepts to search | What the question does not decide yet |
|---|---|---|
| Methods / techniques (RQ1) | Explainable AI · intrusion detection · IoT | Which studies will ultimately be included |
| Evaluation (RQ2) | Detection evaluation · explainability evaluation | Whether a specific metric is sufficient or comparable |
For a computing topic, PICOC can help structure Population, Intervention, Comparison, Outcome and Context. Some elements—especially Comparison—may not be needed as search concepts. Select concepts based on the question and the available literature.
STEP 03
Keyword Matrix & Boolean Search
The matrix below is a starting set of candidate terms. Confirm terminology using seed-paper titles/abstracts, author keywords, database records and the scope of the review.
| Concept | Candidate terms | Check before using |
|---|---|---|
| Explainable AI | "explainable AI" · "explainable artificial intelligence" · XAI · explainability | XAI can be ambiguous; inspect actual records and test recall. |
| Intrusion detection | "intrusion detection" · "intrusion detection system" · anomaly detection | Check whether anomaly detection belongs in the stated scope. |
| IoT context | IoT · "Internet of Things" · Internet-of-Things | Check spelling, hyphen and field-search behaviour per platform. |
Generic Boolean draft
("explainable AI" OR "explainable artificial intelligence" OR XAI OR explainability) AND ("intrusion detection" OR "intrusion detection system" OR "anomaly detection") AND (IoT OR "Internet of Things")This is a generic classroom draft. Search syntax and operator behaviour vary by database. Test it, adapt it using official help, and document the exact version actually run.
Open the interactive Keyword Matrix & Boolean Search builder →STEP 04
Database Selection
Choose sources because their scope fits the research question. These are example considerations, not a requirement to search every source.
| Source | Possible role in this example | Decision to document |
|---|---|---|
| Scopus | Multidisciplinary citation-indexing database | Coverage, subscription access and fields to search |
| Web of Science Core Collection | Multidisciplinary citation-indexing database | Available indexes and overlap with other sources |
| IEEE Xplore | Technical literature in computing, engineering and electronics | Whether its collection adds relevant coverage for this question |
| ScienceDirect / Springer Nature Link | Publisher platforms that may provide supplementary content | Explain why each platform is needed alongside cross-publisher indexes |
A publisher platform and a citation-indexing database are not interchangeable. Record and justify each source separately; avoid assuming that platform searches provide comprehensive cross-publisher coverage.
Open the Database Selection worksheet →STEP 05
Execute & Refine
- Choose one database and confirm its search interface and searchable fields.
- Adapt the generic string to that database using its official search guidance.
- Run the query and record the exact date, string, fields, filters and actual result count.
- Check whether known relevant seed papers are retrieved. Inspect missed or unexpected records and adjust one concept at a time.
- Record each change as a new search attempt; keep earlier versions for traceability.
Example search record (participant completes after running the search)
Open the Search Log →Database / interface[enter actual source]
Search date[enter actual date]
Exact query and fields[paste exact query]
Filters and result count[enter actual filters and count]
STEP 06
Initial Article Set
- Export records from each source in a supported format, such as RIS, BibTeX or CSV.
- Keep original exports and note which database each file came from.
- Import the records into Zotero and check for duplicates after combining sources.
- Verify titles, authors, year and DOI against original records.
At this point, describe and organize the initial records. Full title/abstract screening, inclusion decisions and quality appraisal belong to later stages.
STEP 07
Stage 1 Portfolio
Before exporting, check that each item connects to the same agreed scope:
Key learning: Stage 1 produces a justified and testable search plan plus an initial set of documented records. The completed search evidence—not a generated answer—is the basis for the next review stage.