{'fraction_non_alphanumeric': 0.03697196889162424, 'fraction_numerical': 0.01912381804957198, 'mean_word_length': 5.138196304691256, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 1, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
A Survey of User Perspectives on Security and Privacy in a Home Networking Environment

The security and privacy of smart home systems, particularly from a home user's perspective, have been a very active research area in recent years. However, via a meta-review of 52 review papers covering related topics (published between 2000 and 2021), this paper shows a lack of a more recent literature review on user perspectives of smart home security and privacy since the 2010s. This identified gap motivated us to conduct a systematic literature review (SLR) covering 126 relevant research papers published from 2010 to 2021. Our SLR led to the discovery of a number of important areas where further research is needed; these include holistic methods that consider a more diverse and heterogeneous range of home devices, interactions between multiple home users, complicated data flow between multiple home devices and home users, some less-studied demographic factors, and advanced conceptual frameworks. Based on these findings, we recommended key future research directions, e.g., research for a better understanding of security and privacy aspects in different multi-device and multi-user contexts, and a more comprehensive ontology on the security and privacy of the smart home covering varying types of home devices and behaviors of different types of home users.


INTRODUCTION
Modern information and telecommunication technologies (ICT) have made today's homes more connected and digitized. With the rapid advancement of artificial intelligence (AI) technologies and their use in modern homes, the more traditional term "home network" is increasingly replaced by more recent one "smart home", which often covers the use of IoT (Internet of Things) home devices with "smart" functionalities and relying on data exchanges with the Internet. Today's smart homes are equipped with many computing/networking and smart devices, sensors, systems, and software applications. According to a 2020 report [101], the average number of connected devices in a household in most Western countries is over 7. All home devices communicate with each other and the network/Internet following a range of different protocols, while interacting with internal and external entities including home users and other individuals [19]. This continuously evolving home networking environment offers a multitude of benefits and opportunities to home users, but also simultaneously presents many challenges, including varied security threats and privacy issues.
• The hybrid nature of a modern home with multiple (inter-)connected devices, including different types of traditional and "smarter" devices, is still under-studied. • The existence of multiple and different types of home users has not been sufficiently considered. • Study of home network and related security and privacy issues in different context and various cross-contextual effects are still under-researched areas. • More research is needed to better understand data flows across multiple devices and users and in different contexts. • Some demographic factors such as location and income of home users are less studied than others. • Research on home users' perspectives in relation to the security and privacy of the home network is predominately focused on a small number of smart devices, e.g., smart speakers and smart cameras. • More advanced theoretical and conceptual frameworks, such as smart home security ontologies, need to be developed to support a more holistic view of security and privacy aspects of a home network environment.
The rest of this paper is structured as follows. Section 2 discusses the general methodology followed to conduct both studies. Sections 3 and 4 explain the methodology and results of the two stages (the meta-review and the SLR), respectively. Note that our meta-review plays the role of the related work section of a more traditional literature review paper. Section 5 summarizes our main findings and recommendations for future research, while the later section concludes the paper.

GENERAL METHODOLOGY
As mentioned in the previous section, the methodology we followed is two-staged: 1) a meta-review to gather the related reviews in this field more systematically and to help formulate research questions for the SLR, and 2) an SLR to collate and analyze the original research in this field. For both the meta-review and the SLR, we followed the PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) method [128], a widely used procedure for conducting SLRs. The procedures followed in both stages of our study are illustrated in Fig. 1.
The PRISMA procedure to identify eligible papers for the systematic review process includes four main steps: (1) identifying pertinent records, (2) screening the selected records based on the exclusion and inclusion criteria, (3) assessing the eligible records, and (4) selecting eligible items for the final study. Since the results of the meta-review were produced systematically and contributed to the selection of our research questions for the SLR, we decided to present both the above scientific process in one flow diagram presented in Fig. 1. For ease of understanding, both these processes are color coded (blue for the SLR, and green for the meta-review) to represent two different processes.
For both stages, a selection of three major scientific databases, Scopus, ACM Digital Library and IEEE Xplore, were considered. We decided to include Scopus as it is regarded as a very comprehensive and interdisciplinary database [21]. Note that Scopus is a product of the largest scientific publisher Elsevier, so research papers published by Elsevier are well covered by Scopus. In addition, we observed that research papers published by other mainstream publishers such as Springer and John Wiley & Sons, Inc. are substantially indexed by Scopus. We decided to include ACM Digital Library and IEEE Xplore as additional databases because ACM and IEEE are the two most important subject-specific publishers for cyber security and smart home research. Although the same query was used for all the databases, each database offered different searching tools, i.e., Scopus supported searching directly into paper title, abstract and keywords (called "meta data"), but ACM Digital Library and IEEE Xplore did not offer such a direct search option, so we decided to search into the abstract only. The results were filtered to include only 'Journal articles', 'Conference proceedings', 'Conference reviews', 'Reviews', and 'Articles in press', published in the English language. Specific keywords used, the inclusion and exclusion criteria for each of the review and the period of search, have been included in the respective methodology sections.
To store, categorize and analyze our data in both stages, we used a widely used research software system called MAXQDA (http://www.MAXQDA.com/). MAXQDA has several useful tools to support different qualitative and quantitative analysis tasks such as "Smart coding tool", "Document variable analysis", "Visual tools", "Memos", "MaxDictio" which were very helpful in our analysis.

META-REVIEW
The meta-review aims to identify, collect, analyze and synthesize the review papers on the subject of security and privacy at home, and helps to formulate the research questions for the main SLR. The meta-review concept is similar to scope review [132] that can be used as a precursor to an SLR to help guide the design of the SLR.

Methodology
Following our research aim, the meta-review focused on the research question: How have existing review papers in the area of security and privacy of home networking covered research on user perspectives?
3.1.1 Search Keywords. Table 1 shows the keywords we used to conduct our search queries. The search strategy includes three main components: the first subset of keywords capture the home networking and smart home context, the second limit our searches to security and privacy-related papers, and the last one covers several typical keywords indicating the nature of the paper as a review or SoK (systematization of knowledge) paper. To follow the screening and eligibility checking steps of the PRISMA process, a set of exclusion and inclusion criteria were established. A paper meeting any one of the exclusions (or inclusion) criteria was excluded (or included).

Exclusion Criteria.
Papers meeting the following exclusion criteria were excluded: • Papers published before 2001 • Non-English papers • Papers that do not cover the home context (e.g., those covering industrial IoT) • Conference reviews or book chapters • Papers that do not cover any security or privacy factors • Papers which are not review papers excepting non-review papers that report any taxonomy covering security, privacy or user perspectives of the home network 3.1.3 Inclusion Criteria. After excluding papers based on the exclusion criteria, those meeting at least one of the following inclusion criteria were selected: • Papers focusing on issues and solutions in the area of security and privacy of the home network • Papers that systematically reviewed smart home and home network related products or applications The non-review papers reporting on ontology or taxonomy relevant to the subjects were considered as pseudo-reviews and were included in the study because they normally systematically conceptualize relevant topics.
In the following, we present the results of the meta-review. Figure 1 (colored in green) shows the results from each step of the meta-review. The initial searches gave us 2,670 papers in total. After removing duplicates, we had 1,647 papers to screen. Following the exclusion criteria in Section 3.1.2, we ended up with 257 papers for further screening. After a scan of those papers' abstracts, introduction and conclusion sections and applying our inclusion criteria presented in Section 3.1.3, 52 papers were included for final analysis. The screening and filtering steps gave us a clear indication of reviews that were conducted in the past on relevant topics, helping to inform the second stage of our work (i.e., the SLR). Table 2 presents an overall comparison of related study with the current research. Note that although all included papers are review papers, only some can be considered SLR (i.e., others were not done following a systematic approach). Table 3 depicts the thematic categorization of the 52 papers in our study based on the broad overall theme that the reviews conveyed.

Security & Privacy in General.
Nineteen papers covered by the meta-review focus on various common issues arising from security and privacy problems in a smart home. DeFranco and Kassab's paper [52] covered the broad theme of general research avenues around smart home. While Kuyucu et al. [99] reviewed papers relating to both privacy and security related issues and solutions, Liao et al. [109] explored security problems, challenges, techniques used, and solutions available from a mobile computing point of view. Talal et al. [175] focused on security issues of tele-medicine environment exploring smart home issues and solutions in general and hardware sensors, protocols, wireless network, security architecture, in particular. Philip et al. [147] published a similar study on home health monitoring systems. Bolton et al. [33] surveyed the security and privacy challenges of virtual assistants such as 'Siri' by Apple. Barriga A. and Yoo [23] discussed existing security mechanisms and approaches in a smart home automation system, while Batalla et al. [25] analyzed the security requirements and countermeasures used in a general IoT architecture and suggested an extendable home area network with multi-level privacy and security to be managed by a trusted external actor to lessen the burden on home users. Other topics covered in some reviews include smart home data protection issues [43] and security issues in different layers of smart home network [172]. Three papers chose to focus on specific areas in the smart home security. These include, Ambient Intelligence (AmI) applications and their privacy issues by Lopez et al. [111], major wireless protocols such as Zigbee and Z-wave by Marksteiner et al. [115], and, and security and protection mechanism in face detection techniques by Fatima et al. [55]. Papers also looked into general smart home related topics, i.e., Vasanth et al. [185] who discussed on smart home automation and trust building factors, Whereas, Michler et al. [124] investigated research work on trust-building factors in consumer IoT products in four areas including smart home. Reviews also considered alternative approaches to different security issues in a home network such as utilizing fog-computing architecture [151], smart home safety and security using Ardunio platform [159] and using software defined networking (SDN) [17] to control home network security.

User Perspectives.
We identified ten papers that reviewed the literature on privacy and security issues from home users' perspectives. Out of all 10 papers, Howe et al. [80]'s research was the only paper which touched upon many of the areas we wanted to review, although it is a very old review (2012). This research focused on the psychology and factors influencing users' security behaviors and decisions. It explored various demographic characteristics, information sources for home users, users' understanding of security risks, their perception of security behaviors and defensive security actions.
Wilson et al. [191] analyzed 150 relevant papers and organized their findings into three broad themes of 1) growth of smart home from 'functional', 'instrumental' and 'socio-technical' viewpoints, 2) users and their use of smart home with the subcategories of 'prospective users', 'interactions and decisions' and 'technology in the home', and 3) challenges in a smart home covering hardware and software, design and domestication issues. Alotaibi et al. [14] reviewed research work on security awareness and education amongst home users recommended an individualized approach to provide information to users based on their existing awareness level. Michler et al. [124] analyzed user perception from the angle of trust to understand smart home adoption issues.
Two papers explored the elderly users' prospective on using smart home. Pal et al. [142]'s systematic review on the elderly users' perspective on smart homes, observed that the elderly population have serious security and privacy concerns on the use of smart devices. In another systematic review, Yusif et al. [198] focused on assistive technology use by older people and noted that 34% of the articles examined, recognized privacy as a major concern for the older adults.
The other four papers differed widely in their topic choices. After having systematically reviewed privacy-related papers, Kraemer and Flechais [96] concluded that contextual privacy at home and privacy behaviors were very under-researched areas. The concept of privacy paradox and related studies were covered in two reviews [24,180]. Li et al. [107] conducted a systematic review to find the motivation, barriers and risk of smart home adoption from a consumer's point of view.

Threats and Attacks.
We found nine papers reviewing various aspects of security threats, attack types. Abrishamchi et al. [2] discussed different types of side-channel threats in a smart home, giving a categorical view of different devices and systems layers in a smart home that leaks private data. Heartfield et al. [78] on the other hand, produced a taxonomic view of the possible cyberphysical threats and their impact on smart home. Alrawi et al. [16] produced a systematized view of the research literature on smart home security arena, under 4 major categories: 'device', 'mobile application', 'cloud endpoint' and 'communication'. Papers were further sub-categorized into 'Attack vector', 'Mitigation', and 'Stakeholder' and evaluated with 45 IoT devices to identify the research gaps. Researchers also explored the security vulnerabilities by different IoT devices [51] and smart home devices [45]. Batalla et al. [25] classified the security threats in home area network devices by referring to the 3-layered approach of ENISA (European Union agency for Cybersecurity), i.e., perceptual, network and the application layer attack and physical attacks. Implantable, wearables and embedded sensors were another topic of discussion [90] along with security measures in mobile computing [109].

Security & Privacy
Solutions. Thirteen papers focused on solutions to specific security and privacy problems in a smart home. Chakraborti et al. [41] reviewed research work on software solutions and embedded solutions in a smart home. Two of the papers [131,158] reviewed blockchain-based solutions for addressing security and privacy problems of a smart home. Three papers focused on different areas of smart home solutions, including current fog-based literature [151], research on software-defined networks (SDN) [17] and smart home safety and security systems focusing specifically based on the Arduino platform [159]. Kuyucu et al. [99] reviewed papers both on issues and solutions. We found six papers reviewing the existing literature on authentication schemes and various security threats to them. Four papers [11,62,127,133] provided a general classification of different authentication schemes, threats and attacks on IoT devices in a smart home. Other such as Ghazali and Zakaria [66] extensively reviewed the biometric factors reflecting on the authentication mechanisms inside a smart home whereas, Gupta et al. [75] focused on a comparative study of different encryption algorithms used in IoT platform and proposed solutions to increase energy efficiency of various systems.

Smart Home
Devices. Nine papers covered in the meta-review focused on smart home devices, without looking at the system or user level aspects where multiple devices form a home network. Varghese and Hayajneh [184] reviewed research on security and privacy of different categories of smart home devices. Ray et al. [152] provided an in-depth discussion on IoT-based biosensors. Four other papers covered other specific areas including smart TV [10], hybrid broadcasting broadband TV (HbbTV) techniques [67], video surveillance methods [35], implantable and wearable medical devices, detectors and control systems such as temperature sensors or smoke detectors [90]. Edu et al. [54] reviewed research work on smart home personal assistants (SPA) to examine the main security and privacy issues, features that characterize known attacks, limitations of countermeasures. Features and challenges of smart gateway systems [194] and assisted smart home technologies for elderly people [69] are two other areas of discussion under this category.

Discussions & Research Questions
Identified for the SLR. The meta-review led to several key findings.
• First, although ten papers covered user perspectives in different ways, the discussions have not considered papers from both the security and privacy angle. The reviews have reflected on the privacy issues [96,180], educational awareness [14] and general challenges users face with very little focus on security and privacy [191]. The "User Perspective" as discussed in Section 1, comprises a much broader domain. Only Howe et al. [80] discussed a more comprehensive details of user perspectives including behaviors and practices of users, but the study is relatively old (published in 2012). There is therefore a need of collating and synthesizing more studies in this growing area. • Second, 42 review papers collectively cover different aspects of smart home research, including specific (types of) smart home devices, privacy and security issues, and technical solutions. We noticed the absence of wider discussions and a more holistic view of a smart home where multiple and heterogeneous devices are interacting with each other and home users. • Third, as reported in [96], contextual aspects of security and privacy of home network have been much less studied. Based on the above findings, we decided to define the following more focused research questions for the SLR in the second stage of our work, as presented in Table 4.
As is evident from the paper, the boundary between RQ3, RQ4 and RQ5 is not a clear-cut one. Broadly speaking, RQ3 focuses more on the knowledge of home users on facts related to security and privacy matters in the home networking context; RQ4 focuses more on home users' concerns (i.e., perceived risks and problems), including not only concerns caused by awareness of genuine security and privacy issues, but also those caused by false perception or misunderstanding of (possibly non-existing) security and privacy issues; and RQ5 looks more at what home users actually do (behaviors and practices) and the reasons behind them (attitudes, motivation, perception). RQ5 has a broader scope and may be argued to include RQ3 and RQ4 as two sub-questions, since actual behaviors and practices may also be caused by (lack of) awareness and/or concerns.

SYSTEMATIC LITERATURE REVIEW (SLR)
The SLR was conducted in line with the 9 research questions identified via the meta-review reported at the end of the previous section, examining related original (i.e., non-review) research work in the literature from 2010 till 2021. There are two reasons why we decided to exclude papers published before 2010. First, we wanted to focus on more recent research (the past decade), which is a common practice for SLRs [89,182]. Our results showed that relevant research was indeed more done in the past several years (see Figure 2). Second, Howe et al.'s review work [80] conducted in 2012 covered original research papers published before 2010 quite comprehensively. Table 4. Research questions (RQs) identified for the follow-up SLR via the meta-review RQ1 Has the current literature paid attention to the security and privacy perspectives of users within a home network in a holistic manner? RQ2 Is there any research exploring home users perspectives on security and privacy of multiple inter-connected devices in a home network? RQ3 What is the current research on users' awareness of security and privacy issues of a home network? RQ4 To what extent researchers have explored the security and privacy concerns of users in a home network? RQ5 What type of user security behaviors and practices in a home network have been researched? RQ6 What research has been conducted to understand the difference in users security and privacy behaviors and practices in a multi-user home network? RQ7 What demographic factors have been studied while exploring home users' perspectives on security and privacy aspects in a home network? RQ8 How have different contexts of a home network been considered when studying home users' perspectives regarding security and privacy aspects? RQ9 What theoretical and conceptual frameworks have been proposed and used to facilitate studies on user perspectives regarding security and privacy aspects of a home network?

Methodology
As mentioned in Section 2, we followed the same PRISMA method [128,140] for the SLR, following the exclusion and inclusion criteria explained below. Similar to what we did for the mata-review, we also considered the term "home" in a broader sense.

Exclusion Criteria.
Papers meeting the following exclusion criteria were excluded: • Papers published before 2010 • Non-English papers • Papers that are not related to a home network context or do not include a significant coverage of home networks • Papers that do not cover any security or privacy aspects • Papers that do not cover home user issues • Papers that have been considered in the meta-review reported in the previous section, or papers that do not report original research work.

Inclusion Criteria.
Any topics which meets at least one of the relevant areas in the RQs listed in Table 4.

Information Sources & Search Strategy.
As mentioned for the general methodology in Section 2, the same three databases, i.e., Scopus, ACM Digital Library and IEEE Xplorer, were used to search for related research papers. The scope of our SLR was decided mainly by the result of the meta-review which are reflected in our research questions Table 4. The research questions which were formulated as the result of the meta-review guided the process of a keyword selection. The search queries we used for the SLR are formed by four required sets of keywords each covering a different aspect of our RQs: the context of home network or smart home, security or privacy, users, and behaviors (see Table 5). We performed an additional snowballing-based process [65] to identify more relevant papers by analyzing references of the 102 papers selected. Any potentially relevant papers identified went through the same exclusion and inclusion criteria. In total 24 additional papers were identified following this snowballing process, increasing the number of selected papers to 126. The results of the process of searching for and identifying the final selected papers are shown in Figure 1.  Figure 2 demonstrates the yearly trend of selected papers in the past 11 years (2010-2021). As can be seen, the majority of papers were published after 2016, indicating the fact that related research has gained momentum towards the second half of the 2010s. This trend is not surprising given the fact that smart home devices have become more popular more recently, and privacy and security issues around them has become more prominent in the past a few years.

Thematic Analysis of Selected Papers.
In order to answer the nine RQs defined for the SLR, we conducted a thematic analysis of all selected papers and classified them into nine topical themes each corresponding to an RQ, as shown in Table 6 (2016-2021) and Table 7 (2010-2015). Considering the overlaps between RQ3, RQ4 and RQ5, we mapped selected papers to them as follows: papers that explicitly refer to home users' understanding, awareness, perception, knowledge and belief on security and privacy matters in the context of a home network were categorized under RQ3; papers that have an explicit coverage on home users' concerns or worried on security and privacy issues and problems were categorized under RQ4; and papers that cover home users' actual security and privacy behaviors and practices were categorized under RQ5. Comparing papers published in the past six years (2016-2021) and the earlier six years (2010-2015), we can see two revealing  Table 7. Categorization of papers into the 9 RQs (2010-2015). The same legend as in Table 6. [86,88,97,176,193] [108] [79,86,139,186] [189] [190]  patterns: 1) research on related topic has been increasing drastically recently since 2016; and 2) recent papers frequently cover multiple RQs compare to earlier papers, indicating that more researchers realized the complexity of security and privacy issues of home networks and the need to study them from multiple angles. We represented the inclusion of this complexity in the included papers by the following specific graphic symbols: (a) "Substantial coverage" -to represent papers which provided a substantial coverage of one RQ, (b) "Partial coverage" -when a part of the paper is devoted to one RQ, and finally (c) " Light touch" -where a paper discussed about an RQ only briefly. Discussions for each RQ mainly concentrated on the papers which provided a full coverage, while mentioning about the partial coverage. Across all papers published in the 11 years our SLR covered, we can see some popular research areas (e.g., RQ4 "Privacy concerns", RQ5 "Security behaviors and practices", and RQ9 "Theoretical and conceptual frameworks"). In addition, the results also revealed some obviously less-studied areas, especially under RQ2 on multiple inter-connected devices and RQ8 on contextual aspects.
For each RQ, we will discuss the relevant papers covered in our SLR with greater details later, grouping them into different sub-categories within each RQ. Table 8 shows an overview of all the papers which have been mapped to the RQs and the sub-categories within each RQ.

RQ1: Holistic view.
For this RQ, we considered 11 papers that examined security and privacy of home networks from a more holistic point of view.
Papers in this category discussed different aspects, including privacy and security risks of users while adopting to smart devices at home [22,110,141], general challenges for home users and solution [37], comprehensively assessing privacy risks of smart home by investigating the datacollecting capabilities of its integral components and assessing the individual risk they pose [170], general benefits and risks [113,191], the role of trust [56,162], and hybrid nature of modern smart homes [34,136,201]. The last two aspects are of particular interest for RQ1, so we briefly introduce the five papers below with greater details.
The role of trust: Ferraris et al. [56] explored the trust relationship between the user and popular smart devices and suggested an interesting trust model, which would enhance home security in regards to how devices interact with users and other devices. Schomakers et al. [162] discussed how the degree of automation can affect the privacy and trust perception of smart home users by not only exploring privacy from the information security viewpoint but also reflecting on the physical, social and psychological dimensions.
The hybrid nature of modern smart homes: Zhao [201] reflected on the legal definition for the current digital home which has a fluid boundary and discussed some rising problems such as the changing perception of the home's location, the increasing significance of data protection in the home, and the weakening legal enforcement owing to the 'cross border data-flows' and 'complicated industrial supply chain'. Nthala and Flechais [136] investigated data security decisions  [5,93,193] 3 PrivSec awareness in general [57,83,87,103,105,110,113,196,197] 9

RQ4: User Concern
Privacy concerns in general [13,83,104,150,192,196,203]  in the home and proposed to study them by considering the home space in three distinct areas: social, activity-based, and technological spaces. Boussard et al. [34] proposed the concepts of 'vPlace' and 'vSpace', to address the problem of proliferation of poorly secured IoT devices at home. 'vPlace' is the collection of all registered resources in the home network and external devices owned by home users along with their dynamic states of connection to the network of connected or not connected to the network, and 'vSpace' refers to virtual spaces or rooms oriented towards different contexts of family, work (from home) or visitors.
Some recommended solutions proposed in research falling into this category are interesting, such as calculating privacy risks from the data collection capabilities of a device and dividing the whole home network into physical and virtual places. However, we felt that research should take into account co-existence of different (both smart and traditional) devices in a home network, exploring whether people's security and privacy behaviors and actions are different in different types of home networks such as in a student accommodation, an Airbnb or a shared flat. 4.2.5 RQ2: Multiple inter-connected devices. For this theme, we found only a small number of (four) papers [7,34,119,166], which are briefly introduced below.
Al Abdulwahid et al. [7] focused on the unavailability of a common authentication technique using multiple digital devices. Boussard et al. [34]'s vPlace and vSpace concepts, introduced previously for RQ1, utilized the software-defined network (SDN) technique to manage access control in a multi-user home network with multiple devices. Sikder et al. [166] discussed the complex and conflicting demands of multiple users in a multi-device home compared to a single-users environments and suggested a new access control system called Kratos to enhance awareness of related environment. Marky et al. [119] (lab-based study, = 15) found that users would prefer to have detailed information about each device, a clear status communication, more dynamic and rule-based settings, and delegation options to adjust privacy settings in a multi-device setting.
The limited research on RQ2 suggests the need for research in the field of interconnections and interactions between multiple home devices, and any consequential security and privacy problems.
4.2.6 RQ3: Security and privacy awareness of home users. 35 papers covered in our SLR studied users' awareness and perception of security and privacy in the context of home networking, with 24 papers substantially covering this topic.
The effect of workplace training and the subsequent cyber awareness for home users is a topic that has received some attention. While some researchers investigated organizational, social and personal factors that can affect cyber security awareness of home users and attributed the cyber awareness of the home users to personal initiatives' knowledge, others such as Talib et al. [176] and Kritzinger and von Solms [97] recommended organized security awareness programs at the workplace to help boost home users' cyber awareness. Kang et al. [88] and McDermott et al. [121] suggested the absence of a direct relationship between people's technical background and their security or privacy awareness.
The topic of low privacy awareness is another popular topic discussed by many researchers [53, 67, 116-118, 146, 163, 202], owing to reasons such as the absence of audio-visual inputs [202] or a low level of self-efficacy [146]. On the positive side, it was also reported that home users are willing to engage in privacy protective mechanism, if relevant tools are easy to understand and cheap [53]. Through an online role-playing exercise, Binns et al. [31] (online role playing scenario, = 27), found that home users' privacy-related decisions are heavily influenced by their preexisting perceptions of and relationships with companies (more precisely, mobile app suppliers). They suggested privacy-aware tools that can help users to incorporate such pre-existing contextual factors into their privacy-related decisions. Two studies [27,95] suggested using augmented reality related solutions to make home users aware of privacy issues and to encourage them to make more informed decisions. Wickramasinghe and Reinhardt [188] (survey, = 229), observed that users had a lack of knowledge of sensitive data collected by smart objects and the thirds parties receiving such data. Zeng et al. [199] (interview, = 15), suggested how users' vulnerability depends on the level of their privacy knowledge, and pointed out a clear mismatch between the awareness and power of the owner/administrator of the smart home in comparison to other home users. Freudenreich et al. [58] (interview, = 16), studied security practices of home users related to Wi-Fi security and found that, although they were mostly aware of the vulnerabilities, they found it difficult to address these issues.
Due to the growing popularity of smart speakers (also called smart/intelligent personal assistants or voice assistants -we will use the shorter term "smart speaker" hereinafter), some studies [1,85,113] looked into different security and privacy aspects of smart speakers. They found that, home users were generally aware of personal data being stored on smart speakers, but not with the service provider and in some cases with other third parties. Most users were not even aware that they could review or delete the stored data [113]. The incomplete mental model on different privacy issues [1] or lack of knowledge on the matter [98] leads to various privacy concerns. Park and Lim's research [145] demonstrated that at times, when users are more aware of their privacy, they expected their own personal space oriented features in the smart speakers.
Three papers looked at different types of home users. Kim et al. [93] (trend analysis = 23; interview = 20; survey = 188) categorized users into different groups depending on the level of their cyber awareness. For example, 'Innocent Irene' (extreme low level of awareness) or 'Parental Patrick' (people with a family to protect). They suggested designing smart devices to suit to home users' cyber personality. Xavier and Pati [193] (survey, = 324) pointed out how lack of awareness affects the ability to understand security threats whereas Ahmad et al. [5] focused on lack of parental awareness on the topic of cyber threat towards children at home.
Home user awareness and perception were also addressed in nine papers [57,83,87,103,105,110,113,196,197], while focusing on other related concepts such as privacy and security concerns, privacy and security behaviors of single and multi-users and contextual security at home.
Research on RQ3 has a noticeable focus on privacy awareness, possibly because privacy issues of smart devices such as smart speakers are more visible and understandable by home users than (technical) security issues. The research on the effect of workforce training was a topic we did not expect, showing how home and work contexts can be connected. Discussions on user awareness on topics such as issues from connected home, existing tools and supports to mitigate issues arising, understanding of home user on legal and economical help available in case of security breach are surprisingly thin and important areas to focus on. 4.2.7 RQ4: Security and privacy concerns of home users. RQ4 is one of the most discussed themes, with 47 papers covering a range of related topics, with 36 of them focusing majorly on this RQ. The other 11 papers [9,28,29,59,88,134,141,143,153,197,199] focused more on topics in other RQs such as multi-user concept or user behaviors, so they will be covered elsewhere.
Seven papers looked at privacy concerns in a more broader and systematic sense. In order to understand the privacy concerns of home users, Zimmermann et al. [203] (interview = 42) categorized home user concerns under two types, 'unrelated to attacks' such as dependency on a technology or loss of control to use, and 'related to attacks' such as smart home data exposure and manipulation of device sensors. Worthy et al. [192] (experiment, = 5) collected daily use data from the participated homes with a specially developed IoT device, to find that that users tend to demand more control over the information collection process when they have less trust on the data controller and consumers. Through an empirical analysis involving 265 valid respondents, Lee [104] (survey, = 300) observed a positive association between different types of vulnerabilities ('Technological', 'Legal' and 'User') and IoT privacy concern, except provider vulnerabilities. Hwang et al. [83] (survey, = 300) revealed different levels of privacy risk perception for different types of home IoT services, venturing into a trade-off between privacy and functionalities. This tradeoff is also re-iterated by a study conducted by Psychoula et al. [150](survey = 231; interview = 41). Yao et al. [196] explored user-centered privacy design (Co-design study, = 25) to demonstrate home users' conceptualization of privacy control mechanisms. They identified six factors (Data Transparency & Control', 'Security', 'safety', 'Usability', 'Contextual detection & Personalizing', and 'System Modality') to help design smart home privacy controls. A study [13] focused on understanding Saudi home users' privacy and security concerns of using smart devices, and revealed that 79.7% of Saudi users were afraid of losing their data because of low awareness of related issues and the lack of governmental interventions.
Eleven papers discussed privacy concerns on smart speakers, the most popular topic under RQ4, and discussed it from many angles, i.e., lack of privacy concerns by users, contextual privacy concerns, data collection behaviors of the manufacturers, the underlying behaviors such as trust and psychological factors. Lau et al. [103] conducted a diary study with 34 smart speaker user and non-users, to find that smart speaker users lacked knowledge on privacy risks whereas non-users lacked trust on the vendors. This was further highlighted by Malkin et al. [113] and Chalhoub and Flechais [42], who commented on how users preferred comfort to privacy because of the low level of privacy concern and any desire to observe privacy behaviors is inhibited by the lack of user-friendly interface. Concerns about the privacy risks that smart speakers can track and listen to users' data were observed in two studies [46,85]. Fruchter and Liccardi [60] used different NLP (natural language processing) tools to process 109,536 online user reviews on Amazon Echo and Google Home for the presence of specific security and privacy-oriented keywords. Only 2% of the reviews using those keywords showed major concerns about data collection. Manikonda et al. [114] examined online reviews to note users' positive outlook towards the smart speakers and a good level of privacy. Mols et al.'s explorative study (survey, = 325; focus group, = 35) on the Dutch households' privacy concerns [130] provided a multi-dimensional understanding of users' concerns including surveillance, device security, day-to-day user behaviors and transparency of platforms. Lutz and Newlands [112] (survey, = 325) discussed privacy concerns related to smart speakers from a contextual perspective, suggesting that such concerns vary depending on the source. Two papers focused on users' concerns about the data collection behaviors of smart speaker manufacturers. Huang et al. [82] investigated shared use of smart speakers (interviews, = 26), and observed that participants expressed privacy concerns about their housemates and visitors, and also about privacy-invasive data collection by speaker manufacturers. Park et al. [144] (survey, = 359) noticed that privacy concerns led to negative privacy-coping behaviors such as anger, anxiety and disappointment against the relevant companies, and generate bad words of mouth or disengagement.
Reflection on the underlying behaviors such as psychological and trust behind users' concerns about smart speakers was explored in two papers. Liao et al.'s investigation (survey, = 1160) on the role of privacy and trust in users' decisions on adopting smart speakers [110] revealed that, users tend to trust the vendors (Google, Amazon, and Apple) on the usage of their information, and privacy concerns differ between people who use different hardware devices (a smart phone or a smart speaker) to interact with the agent. Ghosh and Eastin [68] (survey, = 289) examined different psychological mechanisms underlying home user's interaction with software agents such as Alexa and Siri and hardware devices such as smart speakers and smart phones, and how they affect privacy concerns and information disclosure behaviors. Similar to what Ghosh and Eastin [68]'s study explained about how participants are more likely to report on higher privacy concerns when interacting with voice assistants through smart speakers than through smart phones.
Parental privacy concern was discussed in three papers. Reflecting on parent's technology usage, control and concerns, Alqhatani and Lipford [15] (interview, = 20) stated that parents did discuss children's privacy and security concerns regarding their online use and controls but did not expand on these to include smart devices. In contrast, Prasad et al. [149] (interview, = 20) considered parental privacy concerns towards service providers and manufacturers and how they affect their children. Sun et al. [171] (interview, = 23) identified six factors which, according to them, influence parents' perception of privacy risks, including parenting style, tech-savviness, trust in manufacturer, age of the children, features of the used devices and news media reporting.
While twelve papers considered other aspects which might affect privacy concerns of home users. Golbeck [70] analyzed 501 online comments to find out that 81% of the home user have concerns about using their Internet Service Providers (ISP) supplied home router as a public Wi-Fi hot-spot. Privacy concern was found to be the most prevalent ethical concern in a study (survey, = 631) by Seymour et al. [165]. Through their study on authentication management techniques of home users ( = 93), Alam et al. [9] revealed that this type of privacy concerns does not actually reflect users' practices. Grünewald and Reisch [71]'s study (survey, = 701) revealed that participants were more inclined to share their location data for services (50%), than with service providers (28%), but struggled with differentiating between the two. Lee and Kobsa [105] conducted a clustering analysis based on data collected from 200 participants on 2,800 hypothetical IoT scenarios and five contextual parameters ('where', 'what', 'who', 'reason' and 'persistence') affecting home users' privacy concerns, to find scenarios according to their privacy risks. A new theoretical model (which will be discussed more in RQ9) was suggested by Guhr et al. [72] to find out the role, privacy concerns plays in home users' acceptance of smart home technology. [49] demonstrated the fact that the discussion and design efforts for any sort of privacy mechanisms should focus on managing human relationships rather than controlling data flows. Both Barbosa et al. [22] and Cannizzaro et al. [40] commented on users' reluctance on home IoT adoption due to their privacy concerns, and how such reluctance grows with age [40]. Devices and platforms other than smart devices such as ambient assisted living (AAL) [47], mobile-assisted robots [154] were also studied to understand the type of privacy concerns they might generate. Wilkowska et al. [190] used three different methodologies, i.e., a focus group( = 42), a survey( = 104) and an experimental usability study( = 55), to study home users' privacy concerns in the context of AAL and found that the level of privacy concerns of participants observed, following each methodology differed significantly.

Results of Crabtree et al.'s research
Finally, one paper paid attention to the role of cultural background in privacy concerns: Huang and Wu [81] conducted a small interview study with nine Chinese smart home users, showing some preliminary evidence regarding their privacy concerns likely being less than an average American user (based on past American privacy-related studies).
Multiple papers related to RQ4 focused on a specific type of smart devices -smart speakers. The trade-offs between privacy and functionality, how privacy concerns affected the decision of smart home adoption, are also relatively popular topics of discussion. However, we found that some smart home devices such as smart home appliances are much less studied, despite the increasing use of these devices in modern smart homes.

RQ5: Security & privacy behaviors and practices of home users.
This is another popular area of research, with 66 papers. Some papers (32) focused majorly on this RQ and others (34) reflected on security and privacy behaviors while discussing other concepts such as privacy concerns, awareness, multi-users issues and related conceptual frameworks [4,47,58,61,63,68,70,84,98,100,103,105,114,116,118,123,126,130,134,135,141,144,146,150,164,167,173,178,181,183,187,188,195,200,202]. Here, we will focus on the 32 papers in the former group.
Security practice related decision was discussed in four papers. Nthala and Flechais [136] in their study, (interview, = 15) identified four themes ( stimuli (cues to action), support, stakeholders, and context) around home users' security practice related decisions. In a follow-up work (interviews, = 50) [138], they found that home users majorly rely on family and friends as an informal support network. Furthermore, in another follow-up work (survey, = 1, 128; interview, = 65) [137], they found that security practice is affected by survival/outcome bias, factors undermining confidence in a security measure, in addition to other well known factors such as trust, cost, knowledge and skill. Alam et al. [9] observed that despite being very concerned about their privacy and security, users don't follow appropriate security steps.
Management and configuration of smart devices was explored in three papers. Kaaz et al. [87] (experiment, = 7) found that, contrary to the popular belief, smart devices are not 'plug and play' and a majority of home users face multiple barriers while configuring such devices, which often force them to accept vendors' default (possibly flawed) security and privacy settings. Ho et al. [79], in an earlier (2010) study on home wireless networks, revealed how home users depended on out-of-box security tools provided by manufacturers, hardly changed the default security settings, rarely installed and maintained encryption keys across devices, and did not perceive any differences between encryption and access control. Topa and Karyda [179] collected and analyzed a broad spectrum of privacy and security issues on usability of security tools such as VPNs, anti-virus and anti-spyware programs (scenario-based, survey, = 150; interview, = 112) to highlight the need of detailed help, consistency regarding use of technical terms, concerns over the use of personal data, and the absence of appropriate usability tools for disabled users.
Seven studies looked at security behaviors affecting home users' security practices for home networks. Anderson and Agarwal [18] observed (survey, = 600) that home users' security behaviors were influenced by cognitive, social and psychological components and hence, all such factors should be considered when analyzing their security attitudes. He et al. [77] (survey, = 425) confirmed a proposed hypothesis that, participants focused on IoT devices' capabilities rather than the devices themselves to define access control and authentication policies. Binns et al. [31] concluded that, home users' security actions are mostly influenced by their preconceived notion about the company responsible for the specific hardware device or software (e.g., a mobile app). However, Dupuis and Ebenezer [53] were of the opinion that home users would be more willing to take precautionary actions if they clearly understand the security mechanisms of the products they use. Via a mixed-method study (survey, = 1, 006; interview, = 14), Taieb and Pelet [174] observed that home users' attitudes and perception towards IoT devices and the security of their data depend on the device type, e.g., a smart health device could induce them to share more information than a smart speaker. Worthy et al. [192] conducted an experiment to collect data from five different households for a period of 10-14 days and analyzed the inhabitants' behaviors. They observed that the participants became familiar with new devices very soon and were generally happy with sharing data as long as it is properly de-identified (e.g., via aggregation) and they were aware of the purpose of collection. Risks associated with Wi-Fi vulnerabilities in home users were explored by Freudenreich et al. [58] (survey and interview, = 16), who found that, although generally aware of the privacy risks, people were not knowledgeable or skilled to address such problems.
The need of personalized approaches is highlighted in some work. Both Wash and Rader [186] and Forget et al. [57] argued on the unsuitability of 'one size fits all' approach to security. Wash and Rader [186] discussed different 'folk models' of threats that induce a home user to make different security decisions according to their contextual belief. Whereas Forget et al. [57] collected user security behaviors and machine configurations of 73 users for at least 3 months within 9-month time window, and then interviewed 15 users out of the 73 ones. Their results reiterated a finding of Wash and Rader [186] -since home users engage in security behaviors and practices differently, they may benefit from different styles and different levels of interventions for their specific needs.
privacy-specific behaviors of home users were explored in several papers. Crabtree et al. [49] studied digital practices of 20 homes in the UK and found that participants employs a number of 'fine-grained methods'(throwaway emails, ad blockers, cookies, consent forms, private browsing) to manage the flow of their private data securely. Chalhoub and Flechais [42] investigated home users' attitude in terms of the user experience (UX), and pointed out that the lack of users' privacy concerns arose out of their individual perception of the situation and how they traded their privacy needs for the benefits from smart devices. Lau et al. [103] and Malkin et al. [113] found no evidence of privacy-seeking behaviors in users of smart speakers, and observed that users did not use privacy controls already available to them in such devices. Al-Ameen et al. [8] revealed a number of mismatches between users' actual perception of data collection and data sharing by the IoT devices compared to the devices' published privacy policies.
Four papers used machine learning(ML) tools to reflect on home users' privacy or security behaviors. Naeini et al. [134] used ML classifiers to predict users' preferred comfort level and their decision to allow or deny specific data collection, whereas Barbosa et al. [22] implemented a decision tree classifier to suggest how easy affordability as a 'motivator' can defocus privacy as a 'blocker'. Manikonda et al. [114] applied the latent Dirichlet allocation (LDA) algorithm [32] and Word2Vec [125] to understand users' privacy behavior and concerns. Li et al. [106] analyzed home users' security and privacy behavior by examining 15.4 million video streams from 211k Chinese users and observed that frequent use of the camera increases the privacy risks.
Four papers looked at other aspects of user attitudes, perceptions and behaviors. Prasad et al. [149] discovered (focus groups, = 3; interviews, = 14) that parents did not trust device/software manufacturers or ISPs to protect their children from harms when using smart devices, and felt it was their responsibility to do so. Jin et al. [86] discussed a different topic of residential privacy by examining data collected from the Foursquare application and identified several vulnerabilities and privacy risks caused by user behaviors. Oulasvirta et al. [139] used a specific behavioral observation system (BOB) to pool sensor data from designated surveillance devices (Wi-Fi cameras, key-presses from personal computers, smart devices, TV and DVD media centers) to comment on the contextual behavioral change. Abrokwa et al. [3] (survey, = 493) observed no significant privacy behavioral differences between users of two mobile operating systems (iOS and Android).
The RQ5-related papers cover a wide range of topics, e.g., home users' privacy and security behaviors, practices and decisions, and parental behaviors, which mostly focused on issues around standalone devices. As in the case of RQ3 and RQ4, more future research should focus on understanding home users' behaviors and attitudes in a connected home with hybrid devices. 4.2.9 RQ6: Multiple users in a single home. Eighteen papers in our study covered security and privacy issues in a multi-user home environment, in different levels of depth.
Five papers examined privacy of bystanders, e.g., guests and nannies. Yao et al. [197] examined potential privacy concerns and expectations of the bystanders (Focus groups, = 18) and observed strong contextual variations, as they switch their roles under different social relationships. Bernd et al. [29] identified different types of bystanders including nannies, home care attendants, house cleaners and maintenance workers who can be affected by the use of smart devices but are not directly involved in the use of such devices. In a follow-up study, Bernd et al. [28] (interview, = 25) found that nannies expected the existence of smart cameras but wanted transparency of information from their employer (i.e., the homeowner) beforehand and were concerned by potential misuse of collected data. Cobb et al. [48] surveyed 386 incidental users of smart devices, to understand their most typical concerns and the context where it materializes, and recommended better communication between the primary and incidental users. Ahmad et al. [4] (interview, = 19), proposed a concept of 'tangible privacy' for designing IoT devices, to provide stronger privacy assurances to bystanders.
Four other papers discussed challenges in a multi-user home, focusing on access control and configuration managements of home devices by different users in the same home environment. Access control issues in a multi-user home were discussed by three groups of researchers [77,84,200], who conducted scenario-based analyses and discussed challenges of using smart devices in a multi-user environment, including coarse-grained access control resulting in either complete access or no access to users, intended or unintended threats to the primary user's data. Marky et al. [119] investigated a prototype for multi-setting interface to adjust privacy settings by multiple users with multiple devices (experiment, = 15) and found that users prefer ability to access detailed information with the settings. By exploring security and privacy implications in a multi-user home, Zeng and Roesner [200] designed a prototype with different access control features (i.e., location-based, supervisory). They discovered that factors such as usability and configuration complexity, lack of concerns for devices, interference with other functionalities, trust between different home users are some of the reasons why users ignore access control mechanisms. Four researchers [77,84,200] recommended different design changes in smart devices to increase the usability and accessibility of the functionalities to all home users. Additionally, He et al. [77] exploring different types of relationship in a multi-user home ('Babysitter vs. visiting family', and 'Child vs. teenager') found clear differences in different users' desires to have specific access control policies attached to different capabilities of an IoT device. Nine researchers discussed the challenges of device use in a multi-user home by primary and secondary users, mostly focusing on the shared use of smart speaker. Both Malkin et al. [113] and Lau et al. [103] reflected on privacy tensions between primary, secondary and incidental users of smart speakers, while Zeng et al. [199] pointed out unique privacy and security challenges that occur in a multi-user home where incidental users depend on the primary users' knowledge and control.In a related, study (interview, = 21),Marky et al. [116] observed that visitors would usually accept the data collection by smart devices so long as the data is anonymized and recommended to gain awareness and knowledge and evaluate data sensitivity, to exert control over their privacy.
In a follow-up study, Marky et al. [118] (interview, = 42) investigated two related privacy issues -privacy of bystanders to homeowners and privacy of homeowners to bystanders. They recommended that, the IoT designers must pay attention to both bystanders and the users while designing their devices. In their study on mental model of 30 participants, Marky et al. [117] noticed a general lack of awareness amongst visitors about the data flows in a smart home ecosystem. Based on interview data from 26 participants using smart speakers, Huang et al. [82] (interview, = 26) found that participants had different types of concerns about inappropriate access and misuse of personal information by housemates and other external entities, but would follow the same risk management strategies in both cases. Geeng and Roesner [63] conducted a mixed-method study ( = 18) to study the inter-communication, tensions, and challenges in a multi-user home. They observed that the smart home environment mimics the existing power dynamics (i.e., parent-child) in a household, giving smart home drivers more access to functionalities than other users. Park and Lim [145] discussed on the privacy awareness of family members while sharing a smart speaker. Papers related to RQ6 cover mainly two areas, bystander privacy and access control. Users' understanding of the more complicated data flows in a multi-user home is one of the main topic that we felt should be studied more, along with other areas such as threats from malicious secondary users and security and privacy implications of interactions between multiple devices and multiple users.
4.2.10 RQ7: Demographic factors and their effects. Seventeen papers in our study substantially covered topics related to this RQ. Five papers studied home users' security behaviors, practices and concerns, with a focus on gender. Wilkowska and Ziefle [189] studied the use of e-health technologies at home ( = 104, 60 females and 44 males), showing that female and healthy adults were more prone to demand stringent security and privacy standards than male adults and ailing elderly, respectively. In contrast, Nohlberg and Kävrestad's survey (152 participants, 53 females and 99 males) [135] found men to be more decisive in comparison to women in an information security decision. McGill and Thompson [123] surveyed 624 users (234 females and 390 males) and their results echoed Nohlberg and Kävrestad's finding that security behaviors of female users are weaker than male users'. Furini et al. [61] conducted a small study during the 2020 COVID-19 lockdown on people's privacy behaviors and concerns on smart speakers, and found that both male and female users had privacy concerns. Looking into gender and IoT use experience, Lee [104] concluded that female users were more concerned by their own vulnerabilities and people without technical experience were more concerned by providers' vulnerabilities. Some other papers focused on demographic factors beyond gender such as age and disability while analyzing privacy and security attitudes and concerns of people using AAL, older adults and other variables such as age, ethnicity, income level and disability. van Heek et al. [183] studied the acceptance of AAL technologies, and the trade-offs between perceived benefits and barriers (survey, = 279). They found that user diversity in terms of age, disability and care giving experience does significantly affect the trade-offs between perceived benefits and barriers. In another related study that used three different methodological approaches (focus groups, survey and a usability study), Wilkowska et al. [190] noticed privacy with regard to AAL technologies is independent of the age or gender. The same conclusion was also drawn by Choukou et al. [47], who compared the attitude of older and younger adults on the use of AAL technology. However, when age was discussed as a factor influencing privacy and security attitude in general (not specific to AAL), it tends to play a significant role in user attitude. Age was a parameter studied by Singh et al. [167] (survey, = 231) who found that older adults (36 -70) were more willing to share data on health grounds than their younger (below 36) counterparts. In their analysis of a large-scale survey with 2,033 UK participants, Cannizzaro et al. [40] noticed that age and education level play a significant role in determining people's trust on IoT devices for security and privacy. In another study, Wash and Rader [186] found that educated users and older adults often exercise fewer precautions in regard to security threat. Klobas et al. [94] reported similar results about security perceptions of older and educated participants who seemed to be more likely to assess security risks of IoT products and had a more positive attitude towards them, although they were still concerned about the privacy and functionality, which does not meet the need of their specific requirements. [30]. Reeder et al. [153] interviewed ten post-menopausal women (age band: 50-70) to understand their perception of wearable devices and found that the participants largely accepted the technology as useful.
Seidl et al. [164]'s study (survey, = 214) found that geo-privacy behaviors are very much linked to a participant's underlying knowledge of the field and similar across different demographic factors including gender, ethnicity and income level. Huang and Wu [81]'s comparative study on Chinese and US users revealed that users' privacy concerns in China seemed to be lower than in Western countries. Lafontaine et al. [100] conducted a survey ( = 232) over three geographic regions (the US, the EU and India) and found that IoT users were comparatively comfortable in accepting risk than non-IoT users. Furthermore, they observed contrasting behaviors of users in different regions, i.e., people in India trust their government more in protecting their data compared to people in the US and the EU.
Papers related to RQ7 studied demographic factors such as gender, age, educational background, disability, ethnicity and income level, and their implications on security and privacy behaviors of home users. There is contradictory evidence of weaker security behaviors of females compared to males, therefore needing more research in this area. We noticed that a majority of the studies focused on developed nations such as the UK, the US and the EU, so more research on developing countries and non-Western countries is much needed.

4.2.11
RQ8: Contextual factors influencing security and privacy behaviors and practices at home. Eleven papers in our study contributed substantially to this theme.
Three papers considered location as the contextual factor. McCreary et al. [120]'s study (video experiment, = 264) found that people were very much concerned about privacy inside their home regardless of the activities they are involved in compared to outside their home. Molina et al. [129] (survey, = 276) asked their participants to imagine using Wi-Fi networks at four different locations (coffee shop, university, Airbnb, and home). One of their hypotheses is that a higher belief in publicness heuristic can lead to less information disclosure. Their results showed positive evidence to support this hypothesis. Naeini et al. [134]'s research (vignette study, = 1, 007) working with a set of 380 IoT data collection and different scenarios revealed the context-dependence and the diverse nature of privacy preferences of home users.
Other researchers analyzed contextual use of devices [139] affecting privacy and security behaviors or leading to specific individual knowledge and experience or device's primary function dictating users' privacy perception [4]. Lee and Kobsa [105] conducted a comprehensive analysis using K-mode clustering analysis, employing data from hypothetical IoT scenarios (survey, = 200). They used K-modes clustering analysis with four clusters ('Very unacceptable', 'Unacceptable', 'Somewhat acceptable', and 'Acceptable') and analyzed the data with five contextual parameters ('where', 'what', 'who', 'reason' and 'persistence') to reflect on the impacts of contextual factors on peoples' privacy perceptions. Apthorpe et al. [20] used the contextual integrity (CI) framework (survey, = 1, 731). They collected 3,849 information flows passing between various first and third-party recipients in a smart home to provide rich insights into why device manufacturers should survey privacy norms in specific contexts and why privacy norms should support restrictive rather than permissive IoT device communications. Tabassum et al.'s [173] study, (interview, = 23) discovered that users' threat modelling of their home and their protection behaviors were not shaped by their existing knowledge, but by their experience in other computing contexts. McGill and Thompson's research (survey, = 629) on users' security behaviors [122] revealed that users perceived to expect more risks from the use of a mobile device than from a home computer. He et al. [77] studied access control issues in multi-user homes ( = 425) and looked at frequent context-dependent capabilities of various IoT devices. They noticed five contextual factors ('Age', 'Location of Device', 'Recent Usage History', 'Time of Day' and 'Location of User') impacted significantly on the implementation of access control capabilities of smart devices. According to Lutz and Newlands's study [112], privacy concerns are dependent on the context of the origin source.
The major areas of discussion on this RQ were location and use of smart devices. However, we feel that some other important contexts need more research, including varying security behaviors and practices of home users when using traditional devices verses smart devices, sharing a particular device with other users, different types of smart devices other than more studied ones such as smart speakers. There is also a lack of research on the legal context, e.g., home users' understanding of the legal support available to them in case of any security or privacy breaches, and their legal rights when it comes to the storage and manipulation of their data on different types of home devices. 4.2.12 RQ9: Theoretical frameworks of security and privacy behaviors. With Eighteen papers in our data set, RQ9 is another much-discussed theme in our study.
Seven papers in this theme [18,53,64,94,122,126,187] discussed users' security behaviors in light of the PMT (Protection Motivation Theory) [156]. Analyzing the survey data from 72 home computer users, Mills and Sahi [126] concluded that participants were not significantly influenced by perceived vulnerability or perceived severity when trying to implement additional security measures on their home computers. However, they identified that response efficacy and self-efficacy were moderate predictors of individuals' intention to implement additional security measures. Klobas et al. [94] study on security risk's influence on smart home adoption (survey, = 405) observed the perceived risk as a determinant of smart home adoption intentions. White et al. [187] used a survey with 945 adult participants to investigate different factors that affect computer security protective behaviors and perceived security incidents. Dupuis and Ebenezer [53] used a mixed-method study under the framework of PMT, using analysis of data from 500 customer reviews of ten IoT devices, 18 interviews, and a large-scale AMT-based online survey with 1,006 valid response, to study the lack of privacy-risk awareness. They found that home users would engage in different privacy protected mechanisms if they are simple to understand and cheap to use. George et al. [64] reiterated this fact in their survey ( = 219), when they found that low awareness of risk coupled with self-efficacy hinders the users from addressing the existing privacy risks. Anderson and Agarwal [18] used PMT to examine security behaviors of 101 participants in a survey with 594 home computer users and an experiment with 101 participants. They concluded that users' security behaviors were influenced by an individualized message focusing on the benefits of good security behaviors.
Two Papers extended the functionalities of PMT for their investigation. Tsai et al. [181] examined how PMT factors predict users' security intentions (survey, = 988). They extended the original PMT theory by including commonly neglected variables such as threat susceptibility, prior experience with a safety hazard, coping self-efficacy, to understand threat perspectives of home computer users while being online. They found several factors such as gender, age, threat severity, prior experience, coping self-efficacy, personal responsibilities amongst others, that are significantly co-related with users' security intentions. Thompson et al. [178] (survey, = 629), included the social and peer influence, psychological ownership and metrics on actual behaviors to measure the effectiveness of these factors on user behaviors under different contexts. Their results demonstrated that users behaved differently under both contexts (personal computers and mobile devices). Their findings echoed the PMT theory by proving the fact that perceived vulnerability, self-efficacy and response cost all played an important role in determining users' security behaviors.
The Theory of Planned Behavior (TPB) proposed by Ajzen in 2011 [6] explains that individuals depend on intention to behave in a certain way and their ability to control that intention. Yang et al. [195]added six external variables to TPB to build a comprehensive new model and validated the model with data collected from 216 survey participants. The results echoed the core concept of TPB that attitude, subjective norm and PBC (perceived behavioral control) are positively related to behavioral intention of the user. Guhr et al. [72] developed a research model based on several theoretical models, including TPB, to measure the effect of privacy concerns on the smart device usage by home users. The study (survey, n=256) applied the partial least squared structural equation modelling (PLS-SEM) to identify four essential elements to represent privacy concerns, including secondary use of personal information, perceived surveillance, perceived intrusion, and awareness of privacy practice. Ferraris et al. [56] as suggested in 4.2.4, put-forward a holistic trust model to improve security at home. Some other old and new conceptual frameworks include the Technology Threat Avoidance Theory (TTAT) for testing the IT Threat avoidance [108], negative-perception modelling for identifying barriers to smart home usage by the elderly user [141], the privacy calculus theory to measure the relationship between perceived privacy risk and the willingness to share privacy information [92], Innovation Resistant theory (IRT) and Multidimensional Development Theory (MDT) to examine privacy concerns by Pal et al. [143] and the new model Perceived surveillance of conversation (PSoC) developed by Frick et al. [59] to determine the cause of privacy concern. Some of the new frameworks include the Stimuli-organisms-responses (S-O-R) framework for measuring the balancing role of negative emotions such as anger, anxiety between privacy concerns and behaviors [144], vulnerability-privacy concern-resistance (VPR) framework for explaining how users' resistance to the adoption of new technology is affected by their privacy concerns and their perception of their vulnerabilities Lee [104].
Although old and new theoretical frameworks have been used/developed to explore home users' security and privacy attitudes, practices and concerns, studies on using such frameworks to analyze security and privacy aspects on the use of smart devices such as smart speakers are largely missing from the papers we covered. In addition, it seems that such frameworks have not been incorporated into relevant ontologies to support related research in a more holistic manner.

DISCUSSIONS & RECOMMENDED RESEARCH DIRECTIONS
The results of our meta-review and SLR showed active and extensive research on different topics in the broad area of user perspectives of security and privacy aspects of home networks. However, our work also revealed many research gaps, indicating that more research is still required. In this section, we summarize our core findings around seven recommended future research directions. Note that some can be mapped to a single RQ of our SLR, but others cross-cut several RQs.

Co-existence of multiple connected devices in a single home
As mentioned in the Introduction Section, the average number of connected devices in an average household in most Western countries is over seven [101]. The existence of many households with multiple home devices calls for more research on the role of co-existence of multiple devices in a single home. Such needs have been met by some research [34,166], but with limited depth and breadth. We observed three main research gaps. First, most research that has been conducted focused on standalone devices or a specific type of devices such as smart speakers [1,42,46,145], smart phone [40], and activity sensors [153]. Although recent research has explored multiple devices in a connected home, especially data flows in a connected home [36,39,91], more research is still needed to investigate how different types of home devices interact with each other, e.g., a smart doorbell with a smart alarm, how such interactions are perceived by the users and how they affect security and privacy of the home network as a whole. Second, the increasing number of home devices in a single home will unavoidably complicate configuration and management of such devices, including their security and privacy settings. Third, a large number of studies have concentrated on specific types of home devices, leaving some types of home devices understudied, especially different types of smart appliance. However, the use of smart appliance at homes has been steadily increasing [102,169], so more research on such devices is much needed.

Multiple users in a single home
According to the PRB (Population Reference Bureau) [148], the average household size worldwide in 2020 was 4.0, suggesting that most home networks have multiple users. Considering frequent and occasional visitors (e.g., neighbors, relatives, friends, carers and nannies) to a household, the number of users can be even larger. There are also more complicated scenarios where the concepts of "home" and "regular occupants" are not clearly defined. For instance, some members of a household split their time between two or even more "homes" (e.g., university students and boarding school pupils live on campus during term time and go back to their parents' house during term breaks), some people living in the same neighborhood may share a broadband router where the "home" network covers multiple households (which we could call an "extended home network"), and students sharing a multi-room house may see it as a "pseudo-home". Note that there can also be a hierarchical or graph-based structure among multiple home users, possibly device-dependent (e.g., a primary user of a home device is a secondary user of another home device). Research on the privacy and security issues in a multi-user home is steadily growing [28,63,82,113,117,118,197,200].
However, most studies in this area are focused on access control issues and power-play relationships between primary and secondary home users, overlooking the issues of an increasingly hybrid and extended home occupants [201]. Research on many aspects of multiple users in a single home, e.g., insider attacks and home users' perception, security and privacy aspects of an "extended home network" and a "pseudo-home" network, is missing from the current research literature.

Multiple contexts and contextual factors/parameters
Our SLR results showed evidence of research mainly in location- [120,129] or device-based contexts [122,173]. Although home itself may be considered a specific context, home users actually use the home network and home devices in the home for many different purposes, leading to multiple different (sub-)contexts of home networking where security and privacy aspects have to be studied differently. For instance, when using traditional computing devices (personal computers) and "smarter" home devices, the context of use is very different. Similarly, when working from home, there is a mixture and overlap between the work and home contexts. Furthermore, when a user brings home devices (e.g., mobile devices and wearables) outside of the home for controlling home devices remotely, an "extended home" context is created. More generally, each unique home networking scenario and each specific type of home device could define a unique context, and the different subsets of home devices that work together for a specific purpose also define different contexts. In addition to contexts defined by different usage scenarios and user intention/purposes, some contexts are more overarching and should be considered part of other contexts, e.g., the legal context regarding data protection matters about home devices that collect personal data. Context-aware security and privacy is a significant research area and some past studies [157] have shown that concepts such as contextual histories dealing with the present and past contexts of the user can be used to enhance the competency and predict future contexts [50] to adept user behaviors. However, as our SLR showed, research on different contexts and contextual factors/parameters is still relatively limited, and future work should venture into less-studied contexts.

Data flows across multiple devices, multiple users and in multiple contexts
Given the existence of multiple devices, multiple users and multiple contexts in a typical home network, and the complicated relationships between them, there can be complicated unidirectional and bidirectional data flows of different kinds, e.g., device-to-device, user-to-user, device-to-user, device-to-Internet, and user-to-Internet (the last two are about data flows between the home and the external world, mainly external online services and cloud servers on the Internet). These data flows might also differ in different contexts. Therefore, understanding such data flows is of particular importance for analyzing security and privacy issues and for developing more effective solutions. Researchers have been working around this topic [38,91,155] with a good deal of work focusing on device-to-Internet phenomena [20,173], but a more systematic endeavor is still lacking. Hence, more comprehensive research is needed to consider the complexities of data flows inside a home and from/to the external world. These might consider different types of data flows between different entities in different contexts, how they lead to security and/or privacy threats and risks, how home users perceive such data flows, how home users respond to any security or privacy concerns, and how technical or socio-technical solutions can be developed based on knowledge of such data flows. In addition, more experimental work is required to test "hidden" data flows that are not explicitly specified in user manuals of home devices and privacy policies of the manufacturers.

Demographic factors
Not surprisingly, our SLR revealed that gender and age are the two mostly studied demographic factors in the literature. Some researchers also looked at effects of other demographic factors such as ethnicity, knowledge, education level, income level, and disability, though with a limited depth. Furthermore, as mentioned in Section 4.2.10, 39% of the studies were conducted in UK, USA and Western Europe, suggesting a need for diversification of countries covered. Chen et al. [44] suggested that, "geographical perspectives" could be instrumental in deciding human behaviors and hence it is important that further research should consider less-studied areas. While some demographic factors have been less or not studied, even for more-studied factor such as gender, we have observed conflicting results, so more research is needed to consolidate our understanding.

Home users' awareness, perceptions, attitudes, behaviors and practices
Although a lot of work has been done on these aspects, the research gaps we identified in the previous subsections suggest that there are still several gaps to be filled by further research. Many factors, including household types, types of home networks including those with multiple geolocations [201], different user structures [118,200], different usage contexts and scenarios, and different demographic factors, can affect home users' awareness, perceptions, attitudes, behaviors and practices. According to some past studies [27,31,73,95], behavioral practices could be influenced by the level of awareness. Although different awareness enhancement initiatives are steadily increasing to help users understand the nuances of security and privacy at home, they are still not effective for non-expert users. Therefore, more research is needed to look into better ways and methods of increasing privacy and security awareness of the users. Furthermore, a number of studies [87,179] looked into issues of device configurations by users. These could be further investigated to address different issues, including weak authentication [177] and multi-user authorization (automatic configuration) [26]. Different ML algorithms including supervised classifiers [22,134] and unsupervised learning algorithms such as LDA [22] have been used in past studies to both predict and analyze user behavior. However, further attention in this area is needed, especially in the context of multi-user and multi-device home to automatically learn and predict multi-user behavior and issues in a connected landscape. In addition to more studies on less-studied areas, some more holistic approaches are clearly needed, e.g., new taxonomies and ontologies that can cover different types of user perspectives and influencing factors.

Theoretical and conceptual frameworks
Our SLR has shown that past studies have considered the use and development of theoretical and conceptual frameworks, but mostly focusing on behavioral frameworks (e.g., PMT and TPB). On a more technical front, many taxonomies and ontologies have also been proposed [19,78,160,168], but they mostly have a limited scope and do not cover user perspectives sufficiently or not at all. More precisely, there is much less work developing theoretical and conceptual frameworks connecting home computing, IoT and smart home, user perspectives, security and privacy aspects, and other important factors. We argue that a more advanced ontology needs developing to have a more holistic and comprehensive view of security and privacy of home networks, covering a wide range of aspects including at least the following: traditional computing devices (including personal computers, routers and switches), smarter devices (including mobile devices, wearables, and IoT devices), physical and virtual network topologies, relevant software tools and online services (including firmware in hardware devices, mobile apps, smart speaker skills, online management tools and services, etc.), household and user structures, demographic factors, mappings between home devices to capabilities, different threats and defense mechanisms, different aspects of user perspectives (including awareness, attitude, perception, purposes and intention, behavior, activities, and practices). Developing such a comprehensive ontology is not trivial, and should be based on existing taxonomies and ontologies covering different areas.

CONCLUSION
The purpose of this study is to conduct a systematic review of published papers on user perspectives of security and privacy aspects of a home network environment. It is evident from the results that this is quite a popular area of research and the number of studies, especially towards the later part of the last decade, has increased significantly in number and in depth. Despite many research papers published, the focus of most past studies is on issues and concerns arising from using a specific type of smart devices (i.e., smart speakers), their security and privacy practices and related decisions, and underlying factors such as user trust and access control issues. Few studies explored the issues of multiple types of connected devices inside a home network (including smart devices, traditional computing devices, multiple smart devices and gateway devices, etc.) or considered the fluid boundaries of a digital home. Additionally, some researchers also discussed multi-user related security and privacy concerns and behaviors. Research also highlighted the role of location-and device-specific contexts, and demographic factors, such as age and gender, in shaping users' security and privacy behaviors. Furthermore, the study collated theoretical and conceptual frameworks explaining the reasoning behind such users' behaviors and actions.
Our work revealed a number of important research gaps and calls for more research in a range of key research areas, particularly around more holistic approaches (such as more advanced conceptual frameworks, especially a more comprehensive home networking and smart home ontology) considering multiple and inter-connected heterogeneous home devices, co-existence of several types of home users and other stakeholders, various contexts, data flows between different entities and in different contexts, and more demographic factors. In other words, we call for more future research to study the multi-dimensional complexity around security and privacy aspects of home networks and user perspectives, in order to make future home networks and smart homes more secure and privacy-friendly and meet people's needs better.