The Literature Review Process

What a Literature Review Is Actually For

A literature review is not a summary of everything ever written on a topic. Its job is narrower: to establish what is already known, what remains unresolved, and where the present study's contribution actually sits.

Before the mechanics of searching and screening, it helps to be clear on what a review is for. It does four things at once: it sharpens a vague topic into a specific, answerable problem by showing where the real gaps are; it improves the study's own methodology, by showing which methods have worked for similar questions and which have failed; it widens the researcher's grasp of the field, which matters especially for a thesis, where the researcher is expected to know the area better than a casual reader would; and it gives the eventual findings something to be compared against, so "we found X" becomes "we found X, which is higher than the Y reported by three earlier studies on comparable datasets." A review that only narrows the topic and stops there has done half the job.

Six Stages of a Literature Review

1. Fix the review question. Narrower than the eventual research question; it decides what counts as relevant literature and what doesn't.
2. Choose databases and search terms. Pick the right databases (the next topic covers this) and build search strings with Boolean operators.
3. Set inclusion and exclusion criteria. Decide, before screening begins, what makes a paper relevant — such as being peer-reviewed and addressing the same threat model — and what rules it out, such as a non-reviewed blog post.
4. Screen and select. Apply the criteria first to titles and abstracts, then to the full text of what remains.
5. Extract and synthesise. Record each paper's method, dataset, and finding in a structured table, and group the papers by theme rather than listing them one after another.
6. Name the gap. State plainly what the reviewed literature hasn't yet answered. This becomes the justification for the study's own research problem.

Building a Search String

Research question: how effective are transformer-based models at detecting phishing URLs, compared with traditional machine learning classifiers? A first search string on IEEE Xplore or the ACM Digital Library might read:

("phishing detection" OR "phishing URL") AND ("transformer" OR "BERT" OR "attention mechanism") AND ("machine learning" OR "classifier")

Near-synonyms are grouped with OR inside brackets, and the three distinct ideas — the task, the method family, and the comparison baseline — are joined with AND. A string with only AND and no synonym grouping will quietly miss every paper that writes "phishing URL classification" instead of "phishing detection." OR widens the net within one idea; AND narrows across ideas.

Snowballing

Database search strings, however carefully built, still miss papers that use unexpected terminology. Snowballing fills that gap by using a paper's citation links instead of keywords. Backward snowballing checks the reference list of a paper already found, looking for earlier work it built on. Forward snowballing checks which later papers cite it, found through Google Scholar or Scopus, looking for work that built on it in turn. Claes Wohlin's widely used guidelines for this technique recommend applying it iteratively: each newly found paper is itself snowballed, until a pass adds nothing new. In practice, a review typically combines an initial database search with one or two rounds of snowballing on its most central results.

Tracking the Funnel

A systematic review typically reports a screening funnel showing exactly how many records survived each stage — something like: 248 records identified through database search, 211 remaining after duplicates removed, 96 screened at title/abstract level, 41 full-text articles assessed for eligibility, and 27 studies finally included. This PRISMA-style funnel lets a reader see exactly how many records were lost at each stage, and why.

Try It Yourself

Your research question is: "Do graph neural networks detect botnet command-and-control traffic more accurately than traditional flow-based classifiers?" Build a search string for this question using the same pattern as the worked example above, grouping synonyms with OR and joining the distinct ideas with AND. Then list one inclusion criterion and one exclusion criterion your screening stage should apply.

Suggested answer:

("graph neural network" OR "GNN" OR "graph-based")
AND ("botnet" OR "C2 traffic" OR "command-and-control")
AND ("detection" OR "classification" OR "flow classifier")

Inclusion: peer-reviewed papers from 2018 onwards reporting a measured detection or classification accuracy. Exclusion: papers that only describe botnet architecture without evaluating a detector, or papers using simulated rather than real C2 traffic.

For a project of any depth, naming the gap isn't quite the end point. A good review also leaves the researcher with either a theoretical framework — the existing theories the study will sit inside or test — or a conceptual framework — the researcher's own working map of which factors are believed to relate to which. A review that stops at "here is what everyone else found" has done the easier half.

Check Your Understanding

You have found one strong paper on ransomware detection using process telemetry. Explain what backward snowballing and forward snowballing would each add that a repeat of your original database search would not.