Tudományos háttér

In recent years, many cyber incidents have occurred in the maritime sector, targeting the information technology (IT) and operational technology (OT) infrastructure. One of the key approaches for handling cyber incidents is cyber security monitoring, which aims at timely detection of cyber attacks with automated methods. Although several literature review papers have been published in the field of maritime cyber security, none of the previous studies has focused on cyber security monitoring. The current paper addresses this research gap and surveys the methods, algorithms, tools and architectures used for cyber security monitoring in the maritime sector. For the survey, a systematic literature review of cyber security monitoring studies is conducted following the Preferred Reporting Items for Systematic reviews and Meta-Analyses (PRISMA) protocol. The first contribution of this paper is the bibliometric analysis of related literature and the identification of the main research themes in previous works. For that purpose, the paper presents a taxonomy for existing studies which highlights the main properties of maritime cyber security monitoring research. The second contribution of this paper is an in-depth analysis of previous works and the identification of research gaps and limitations in existing literature. The gaps and limitations include several dataset and evaluation issues and a number of understudied research topics. Based on these findings, the paper outlines future research directions for cyber security monitoring in the maritime field.

Sea drones are unmanned vessels that operate on or below the water’s surface. During the military conflict between the Russian Federation and Ukraine, the latter has demonstrated how to use sea drones to attack Russian targets efficiently. However, as Russia’s defences against drone attacks are continuously increasing, the cyber resilience of sea drones is becoming increasingly important. Technological developments in shipping have brought new cybersecurity challenges. This paper contributes to the knowledge on augmenting the cyber robustness of maritime autonomous surface-floating and subaqueous drones. Firstly, we aim to support manufacturers in building affordable sea drones that reduce the cyberattack surface of commercial drones. Secondly, we offer guidance for tactical military commanders on the potential cyber weaknesses in a sea drone’s specific operational environments and its reliance on particular technologies. We propose eight distinctive threat categories for cyberattacks against autonomous vessels: attacks to disrupt radio frequency signals; attacks to deceive or degrade sensors; attacks to intercept or modify communications; attacks on operational technology systems; attacks on information technology systems; attacks on artificial intelligence (AI) used for autonomous operations; attacks through supply chains; and attacks through physical access. We use the STRIDE (spoofing, tampering, repudiation, denial of service, elevation of privilege) methodology in the context of each threat scenario, formulate mitigation measures to reduce the risk for each category, and link methods of cyberattack to each category.

As autonomous vessels have advanced Operational Technology (OT) and Information Technology (IT) systems, they face cyberthreats that compromise their security and make it difficult for them to comply with International Regulations for Preventing Collisions at Sea (COLREG). This research addresses cybersecurity issues in the maritime sector, focusing on autonomous ship systems’ vulnerabilities and compliance with the COLREG. The research applies the Process of Attack Simulation and Threat Analysis (PASTA) framework for threat modeling, specifically adapted to the decision-making mechanisms of navigation systems of autonomous ships, to categorize these threats and examine COLREG compliance in potentially complex situations for navigation. This approach proposes an autonomous decision-making system that identifies and counteracts cyberthreats like adversarial attacks, ensuring compliance with COLREG rules. The findings of this study reveal vulnerabilities in communication protocols, decision-making algorithms, and sensor data integrity. It also demonstrates the effectiveness of the PASTA framework in supporting the cybersecurity of autonomous maritime systems, thus enabling safer navigation and compliance with COLREG.

The cyber attack surface in a maritime environment is constantly growing. More current information and computer technologies are being used on cargo and passenger ships to save on operational costs and increase navigational safety. Along with the growing reliance on automation, the risk of a disruption to a vessel's critical systems by drawing on the wrong inputs from sensors to change the behaviour of the actuators has significantly increased. Traditional operational technological systems are much more complicated to update than the automatic software updates we see in information technology systems. To better understand existing cyber threats in the maritime sector and increase cybersecurity resilience, this paper aims to replicate the digital components of a ship's bridge to examine scenarios when the bridge system loses connectivity, receives the wrong inputs from sensors, or the internal system becomes compromised. The simulator differentiates fundamentally from traditional simulators or digital twins in the maritime sector that focus on training seafarers. This environment generates data streams that are similar to those on board a ship. Those data streams can be analysed, modified and spoofed to observe the effects. The effects can be technical but it is equally necessary to analyse how human beings would react in specific circumstances. Our work provides the opportunity to isolate the ship network traffic, conduct penetration testing, find cybersecurity vulnerabilities on devices, and execute cyber attacks without the dangers associated with running such scenarios on a vessel in the open sea.

The world is shifting towards increased digitalisation, severely impacting critical infrastructure like maritime transportation. Electronic navigation equipment—such as echo sounders, sonars, anemometers, gyrocompasses, autopilot systems, GPS receivers, and many other instruments—used on modern ships have undoubtedly decreased naval accidents over the years. Still, these devices may suffer from cyber security vulnerabilities because system developers and vendors often do not consider cyber security aspects. This paper presents a lightweight research environment, focusing on the IEC61162-450 protocol and able to simulate cyber attacks against an Electronic Chart Display and Information System (ECDIS) included in a Multi-Functional Display (MFD). This environment is a vital tool for marine cyber security experts wishing to engage with research addressing existing and potential cyber security vulnerabilities in electronic navigation equipment.

Digitalization is a global trend affecting many critical infrastructures, including maritime transportation. Incorporating information and operational technologies into transportation processes significantly enhances efficiency but also introduces substantial risks originating from cyberspace. It is a significant endeavour to develop lab environments to research offensive and defensive aspects of cybersecurity and facilitate hands-on experience in educational settings. This paper introduces a hybrid cybersecurity research and education lab environment for the maritime domain. It enables real-world data to be fed into a controlled setting equipped with various emulation system components. The lab, which combines open-source and low-cost commercial software, also benefits from virtualization technologies and real hardware devices. Its scalability and affordability make it a viable solution for educational purposes. Although the environment is defended against external access, it can be provided for third parties on demand. We conducted a series of cyberattacks on the network and an open-source navigation application to demonstrate the effectiveness of our lab setting. The recorded and shared network traffic from these attacks not only serves as a fertile ground for our own research but also invites other researchers to develop and test their solutions, fostering a collaborative environment for the advancement of cybersecurity in the sector.

Maritime transport is critical to the global economy; however, it is vulnerable to disruptions impacting global trade. Academia, industry, and national and international organisations make serious efforts to enhance the sector’s resilience, focusing on the cyber aspects as well. With their unique characteristics, marine vehicles and their defence has only recently emerged as a significant area of cyber security study. Existing literature touches upon various aspects of intrusion detection systems (IDSs) as a potential defensive measure for Information Technology (IT) infrastructure against cyber attacks, along with the special characteristics of the marine vehicles that brings the need for solutions considering the uniqueness of the operational technologies (OT). Despite of the reach literature a comprehensive discussion presenting an overall, conceptional view is needed. Our paper, that addresses this need, introduces the different technical aspects to be considered during the design and integration of an IDS into a marine vehicle. To find the relevant details, we conducted a comprehensive literature survey and gathered details that could help the integration process.

The digitalisation of the world is a global trend affecting many industries, including the maritime transport sector. Electronic navigational equipment aboard modern ships has undoubtedly decreased naval accidents, but these devices may suffer from cybersecurity vulnerabilities. One such vector, is its reliance on a great number of protocols for communication. Currently there is limited awareness of the security strengths and weaknesses of maritime protocols, because of the manual-reverse-engineering cost due to their proprietary nature. However, we substantiate that advances in automated protocol reverse-engineering are effectively lowering this cost. Our paper analyses a proprietary protocol, widely used in naval equipment. This protocol was reverse engineered through manual and automated techniques, revealing the advantages and drawbacks of both. Our results show that statistical automated protocol reverse-engineering techniques were sufficient to discover the relevant protocol fields. We introduce the disclosed communication structure and its vulnerabilities, which are both verified by the success of rudimentary attacks. The disclosed protocol, by manual and automated techniques, could also aid intrusion detection (and prevention) system development for maritime operational technology systems, to help vendors avoid the identified vulnerabilities during system design and implementation.

The International Maritime Organisation (IMO) issued regulations to enhance cyber security in the maritime domain. Shipping companies look for compliance with the regulations. Together with industry and academia, they make serious efforts to manage this challenge, but they face difficulties, especially in the case of legacy products. Our research has thoroughly examined the obstacles and has proposed a possible solution. We found that extending ships’ legacy control and navigational systems with an open-source intrusion detection system can significantly contribute to meeting the sector’s requirements.

The International Maritime Organisation (IMO) issued regulations to enhance cyber security in the maritime domain. Researchers suggest deploying open-source intrusion detection systems (IDSs) aboard to ensure the ships’ operational technology network (OTN) complies with these regulations and enhances cyber security readiness. According to previous studies, selecting the optimal IDS is a complex procedure. Our research examines and compares the performance of three open-source IDSs under restricted resources to identify their resource needs, dropped packet ratio, and other software characteristics in virtual and physical environments. Our findings indicate that two of the examined software options can effectively handle the network traffic of ships’ OTNs under restricted resources. However, it’s worth noting that a Raspberry PI, while a popular choice, may not be the most optimal hardware for this purpose.

The global trend of progressive digitalisation of the world is affecting many industries, including the maritime transport sector. Electronic navigation equipment used on board modern ships has undoubtedly decreased naval accidents over the years, but these devices may suffer from cyber security vulnerabilities. The Automatic Identification System (AIS) is a well-studied navigational system with considerable weaknesses. Many publications discuss different methods for detecting anomalies in AIS. Still, validation is often missing or based on synthetic data because of the lack of publicly available AIS datasets, collected from real environments. To satisfy the need for such a dataset, we collected AIS data for six months with a receiver installed near the shore. This paper presents both the dataset and the analysis of the collected data from different perspectives; highlighting the differences between the expected and realistic features of AIS data. In our research we identified several anomalies regarding the AIS transmission propagation and periodicity, and the ship’s positional data. We believe that our realistic dataset, with its labelled anomalies, will serve as an ideal testbed for developing AIS-related anomaly-detection systems.

A global trend in the progressive digitalisation of the world is affecting different industries, including the maritime transport sector. Electronic navigation and autonomous sailing heavily rely on sensor data, such as Global Navigation Satellite Systems (GNSS), Light Detection and Ranging (LIDAR), Radio Detection and Ranging (RADAR), or Automated Identification System (AIS) systems. Interference with these systems can endanger the situational awareness of the ship control system and influence navigation-related decisions. Our research focuses on AIS data and seeks possible features for anomaly detection based on transmission timing, reported and calculated speed analysis. We conducted a comprehensive statistical analysis of a 24-hour-long AIS dataset recorded in Tallinn to highlight the special characteristics of such data. Our findings suggest that the use of a single speed-based feature offers limited benefits, leading us to propose the combination of several speed-based features for anomaly detection. The results of this research have the potential to impact the cyber security of ship’s navigation systems by the identified properties of AIS data.

The Automatic Identification System (AIS) is a tracking system used in vessels and vessel traffic control services to identify and locate vessels and is being regarded as the main tool for complementing the navigator’s direct visual/audible information augmented with RADAR data to prevent collisions at sea. Despite its criticality, AIS in its general use, with the corresponding message broadcasting protocol, is not secured from cyberattacks. Its security vulnerabilities have been extensively discussed in the literature and several real incidents have been reported. To address this issue several research papers have been published proposing anomaly/attack detection systems based either on machine learning (ML) approaches requiring large datasets or on logic-based rule systems built with the help of maritime experts. In this chapter we propose an alternative ML approach to develop an attack detection system using Inductive Logic Programming (ILP), a symbolic AI method, to incrementally learn rules that help detect anomalies in AIS data that potentially could indicate spoofing attacks. As a main result, we demonstrate that ILP frameworks that combine relational logic and numerical reasoning stand out for the ability to generalise from a small set of examples and provide explainable evidence of anomaly occurrence, making it suitable for operational use in maritime environments

Devices that are connected to the Internet are very interesting to security researchers as are at high risk of being attacked, compromised or otherwise abused. To investigate the root causes of the risks it is necessary to understand what classes of devices are affected in different ways. These devices are heterogeneous, thus making it impractical to classify large sets by applying static rules. We propose improvements for manually labelling training sets using HTTP response features for future classification using a neural network.