# Maritime Cyber Threats Detection Framework:
## Building Capabilities

Georgios Potamos, Savvas Theodoulou, Eliana Stavrou, Stavros Stavrou

► To cite this version:

Georgios Potamos, Savvas Theodoulou, Eliana Stavrou, Stavros Stavrou. Maritime Cyber Threats Detection Framework: Building Capabilities. 15th IFIP World Conference on Information Security Education (WISE), Jun 2022, Copenhagen, Denmark. pp.107-129, 10.1007/978-3-031-08172-9_8 . hal-05311500

HAL Id: hal-05311500

https://inria.hal.science/hal-05311500v1

Submitted on 13 Oct 2025

**HAL** is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Maritime Cyber Threats Detection Framework:
## Building Capabilities

Georgios Potamos¹✉, Savvas Theodoulou¹, Eliana Stavrou²✉, and Stavros Stavrou¹

¹ Open University of Cyprus, Nicosia, Cyprus
{georgios.potamos,savvas.theodoulou}@st.ouc.ac.cy,
stavros.stavrou@ouc.ac.cy

² Applied Cyber Security Research Lab, University of Central Lancashire Cyprus, Larnaca, Cyprus
estavrou@uclan.ac.uk

**Abstract.** In recent years, attackers have shifted their attention in the Maritime domain, exploiting vulnerabilities of Maritime IT/OT systems and human resources, and impacting the situational picture onboard the ships and/or at shore infrastructures. Therefore, developing human skills and systems' detection capabilities in the Maritime domain are a critical element to effectively manage the cyber risks related to different types of ships and/or Maritime infrastructures. Such capabilities can greatly contribute to developing a Maritime Cyber Situational Awareness, which can promote the Maritime domain key mission objectives, such as maintaining preparedness, safety, and security. The complexity of the Maritime environment poses a great challenge in detecting cyber threats and/or anomalies in the behavior of systems, due to the different ship-to-shore systems that form this environment. Not being able to detect cyber threats or detect them early enough can affect the effectiveness of decision-making and impact the mission objectives of the Maritime domain. This work investigates detection aspects in the Maritime domain and contributes towards a novel Maritime cyber threat detection framework, to guide the development of relevant human skills and systems' cyber threat detection capabilities. A highlight of this work is the development of a Maritime attack matrix based on MITRE ATT&CK matrices, to clearly specify the cyber threats related to the Maritime surveillance and navigation systems.

**Keywords:** Cyber threats detection · Maritime cybersecurity · Cybersecurity training · Maritime cyber situational awareness

## 1 Introduction

Over the last few years, the Maritime cyber threat landscape has greatly expanded, giving the opportunity to attackers to modify the situational picture onboard ships and/or at shore infrastructures [1], by changing the maneuvering behavior of ships, preventing the detection of malicious actions and causing data leakage. The attack surface in
the Maritime environment contains navigational, surveillance Informational and Operational Technology (IT/OT) and Industrial Control Systems (ICS) [2]. These systems have expanded the attack surface in the Maritime domain, due to the digitalization, the automation, and the integration of systems between ship-to shore. The ship-to-shore data exchange is feasible through the satellite and/or radio data links [3], which are able to provide the required bandwidth to support the exchange of real time data [4]. As a result of the improved communications between ships and shore, and the expanded cyberattack surface, attackers may perform several types of attacks (e.g., malware, Man-in-the-Middle, spoofing, Denial of Service) exploiting vulnerabilities on both IT/OT systems/networks of the ship and/or the Maritime infrastructures (e.g., ports, energy transportation infrastructures, operation centers).

Detecting cyber threats and the relative anomalies of systems in the Maritime environment (onboard/ashore) is a complicated and challenging task due to the different ship-to-shore systems that form this environment. To achieve effective detection of incidents, the security operator shall combine the existing information received by the network and information computing systems, and the information from the interaction of the operational technology systems with the metadata collected from the surveillance systems that are used to produce the Maritime Situational Awareness (MSA). In addition to the need to develop mechanisms and tools to automate the detection of Maritime incidents, it is equally important to focus on the human aspect and train the personnel across all levels of the Maritime workforce hierarchy. Currently, existing work covering the real time detection of cyberattacks in the Maritime context [5, 6] is limited. This poses a great challenge in upskilling the personnel to be able to detect Maritime-related security incidents as they need to have a clear view of many aspects, such as the Maritime cyber threat landscape, the systems involved, be aware of detection technologies and practices, etc. This research focuses on the human and technological aspects for the detection of Maritime cyber threats, proposing a Maritime cyber threat detection framework to build relevant capabilities. The proposed framework can be perceived as a roadmap to build a strong human capacity that is able to effectively detect and handle cybersecurity incidents. It is envisioned that the framework will be utilized to build relevant curricula and run training exercises over appropriate training infrastructures.

Section 2 briefly discusses existing work. Section 3 presents the proposed framework, profiling the Maritime domain, presenting the cyber threat landscape, and specifying core capabilities that need to be developed across the Maritime workforce. Section 4 presents a training activity that was designed taking into consideration the proposed framework. Finally, Sect. 5 provides conclusions.

## 2 Literature Review

Detection of cyber threats should be a high priority for every Maritime organization [6]. In this context, human aspects are of great concern. To this end, cybersecurity training of all stakeholders in the shipping industry [7] should be pursued, due to the necessity
to increase the cyber risk awareness and preparedness, by developing material and practical exercises to build adequate skills [8]. For this purpose, several studies describe the training methods and aspects, covering most of the cybersecurity functional areas [9]. However, there are limited directives with respect to human resources and how to build competencies to detect cyber threats against the Maritime IT/OT systems. Cybersecurity competency frameworks have been proposed in the context of several EU pilot projects (FORESIGHT, SPARTA, Cyber4Europe, CONCORDIA and ECHO) launched to provide valuable insights as to the roles and the cybersecurity competencies that need to be developed in different sectors. However, more investigations and solutions are needed towards creating an organizational culture able to timely detect and mitigate cyber threats against Maritime OT systems. A recent work [10], highlights the relationship between Maritime safety, security, and training and presents a framework to develop a risk aware culture in the Maritime domain. Moreover, applying early warning and deep learning tools [11] can assist in building such capabilities and support the domain's mission objectives [12]. The delivery and continued development of effective training and exercises is critical to the execution and sustainment of detection activities. For the practical exercises, cyber ranges are commonly used as the proper environment to perform offensive and defensive training drills [13, 14].

# 3 Maritime Cyber Threats Detection Framework

## 3.1 Description of the Framework

The proposed framework serves as a roadmap to build the necessary human skills and systems' cyber threats detection capabilities in the Maritime domain. The framework is intended to guide the development of training curricula which can be utilized to train all responsible actors in the Maritime environment and develop their knowledge and skills to be able to detect cyber threats and support effective decision-making. Moreover, the proposed framework is intended to act as a starting point for those that are interested in implementing an infrastructure to detect cyber threats in the Maritime domain. Such an infrastructure can also serve as a training environment and support training curricula.

It is envisioned that the framework can be used by personnel that is responsible to train the Maritime workforce and by personnel that manages cybersecurity incidents. The intended audience for the framework includes the organization's Managing director and the IT managers, the training managers, and the ship IT managers [15]. Senior Management should employ the framework as a guiding tool for protecting a ship's management systems. Trainers and IT managers should consider the framework to implement training curricula and develop a cyber threats detection infrastructure in the Maritime domain. To support the aims of the framework, this work focuses on identifying the knowledge and the skills related to detection aspects in the Maritime domain that should be acquired by all actors and/or build into systems.
<figure><img src="image_3.png" /><figcaption>Fig. 1. Proposed maritime cyber threats detection framework</figcaption></figure>

Figure 1 presents the high-level structure of the framework and its core components. NIST Cybersecurity Framework is taken into consideration to guide the design of the proposed framework and support its objectives. The NIST Cybersecurity Framework aims to assist organizations to manage their cybersecurity risks through five functional areas: Identify, Protect, Detect, Respond and Recover. Although there is a dedicated functional area for detection purposes, other functions can support detection tasks. To be able to effectively develop human skills and systems' cyber threat detection capabilities, one should develop knowledge and skills relevant to all tasks that can support this objective. Identifying all relevant tasks is challenging as they are listed across the NIST Cybersecurity Framework. Given that these tasks are listed in different functional areas, beyond the Detection function, often is not evident which of these are strongly interlinked and can impact the effectiveness of dedicated detection tasks. This research work aims to identify all tasks related to detection aspects and provide insights, increasing understanding of the tasks that need to be undertaken to build human skills and systems' cyber threats detection capabilities. In the scope of this work, the functional areas that were identified to specify core tasks from a detection perspective include: Identify, Protect, Detect, Response, Recover. For each functional area, the tasks that can support detection aspects have been identified and discussed in Sect. 3.2, taking into consideration key Maritime elements, e.g., the Maritime OT systems/sensors appropriate for the navigation and surveillance. Table 1 should be referenced to obtain information about the tasks that should be performed to build detection capabilities. From the analysis in Sect. 3.2, 3 key areas have been identified where is imperative for personnel to build knowledge, at varying degrees depending on their responsibilities. These areas cover domain-related, human, and technical aspects. All these aspects are essential to build strong cyber threats detection capabilities in the Maritime domain and support the establishment of Maritime Cyber Situational Awareness (MCSA). The criticality of the Maritime domain requires the continuous determination of the situation to support the domain's missions. Given
that IT/OT operations support Maritime tasks, the cybersecurity domain is interlinked with the Maritime domain and contributes to the MCSA.

To start building cyber threats detection capabilities, one first needs to obtain a clear view of what the Maritime domain entails, identify all the elements that need to be protected and the relevant cyber threats that can jeopardize Maritime operations. The key characteristics of the Maritime domain are presented in Sect. 3.3. The relevant cyber threat landscape is covered in Sect. 3.4. The aim of these sections is to highlight the key aspects and point the stakeholders of the proposed framework, e.g., curricula designers, to the right direction of the knowledge that needs to be developed.

The next area that needs to be taken into consideration concerns human aspects. To build the workforce's capabilities and contribute to an effective MCSA, it is essential to acknowledge all stakeholders that need to be educated and trained. To achieve effective learning, a focused approach is required that will drive the specification of the cyber threats detection capabilities that should be pursued through a training. This research work specifies a set of 10 key capabilities (Sect. 3.5) that can be considered in training curricula. The aim is to provide a starting point to curricula designers, indicating which capabilities should be considered as a baseline to detect effectively and efficiently cyber threats in the Maritime domain. As indicated in Sect. 3.5, the Maritime workforce has different backgrounds and (technical or non-technical) expertise. It is envisioned that the suggested capabilities can be further elaborated, depending on the audience and the level of knowledge and skills that need to be developed.

Developing an appropriate cyber threats detection infrastructure in the Maritime domain is a challenging task, due to the complexity of this environment. This work aims to highlight key implementation aspects that are essential to establish an effective MCSA. With regards to capabilities building, this work considers the development of a Maritime Cyber Range that simulates the operation of an onboard and/or ashore Maritime Security Operations Centre (Maritime SOC). A SOC can be developed to continuously monitor and detect cybersecurity incidents in the Maritime domain. The challenge is to identify the positions that sensors need to be located so the SOC can collect and analyze appropriate information from Maritime assets. Appropriate training curricula can be delivered over the Maritime Cyber Range, taking benefit of the SOC's operation to build appropriate cyber threats detection skills and knowledge.

To demonstrate the usage of the framework, a training activity is presented in Sect. 4. An attack scenario against Maritime OT Systems is developed as part of the training activity. Moreover, the infrastructure to deliver such training activities will be briefly discussed.

## 3.2 Detection Aspects Across the NIST Cybersecurity Framework

The complexity of the Maritime domain challenges the detection of cyber threats as a clear view of all relevant tasks that should be performed is needed. The NIST Cybersecurity Framework lists tasks across 5 functions as illustrated in Table 1. There are tasks across all functional areas that contribute towards cyber threats detection objectives, however, this knowledge is not always evident and can impact the effectiveness and efficiency of threats' detection. This research work focuses on the identification of all the tasks across the CSF that are related to cyber threat detection aspects in the Maritime
domain, even though they may belong to a different functional area, e.g., identify, protect, etc. The purpose is to highlight to curricula designers the areas where knowledge and skills need to be developed, promoting the development of a strong cyber threats' detection capacity.

Table 1 identifies the categories across the different NIST Cybersecurity Framework functions that include tasks relevant to detection aspects and provides insights as to the knowledge and skills that should be considered in training curricula to build cyber threats detection capabilities. With regards to identity function, the business environment, asset management and governance are driving factors to identify the cyber threats detection requirements relevant to Maritime operations. Risk management entails an assessment of the cyber threat landscape, which is expected to drive the selection and configuration of detection mechanisms. Moreover, the tasks under the protection function contribute to the formation of the cyber threats detection strategy that concerns the utilization of sensors and technologies to monitor Maritime operations and the identification of malicious activities. The detection function involves dedicated tasks related to continuously monitor events and anomalies to identify cyber threats in a timely manner. The effectiveness of the listed tasks is strongly interlinked with tasks from the previous mentioned functions, which specify the detection needs and requirements and drive the specification of the deployed detection mechanisms. Once an event is detected, it needs to be communicated to all appropriate stakeholders and decision-makers, so that actions are taken to respond, limit the impact and recover from a potential compromise.

<table><caption>**Table 1.** Detection aspects in the maritime domain</caption><thead><tr><td>Function</td><td>Category</td><td>Detection aspects</td></tr></thead><tbody><tr><td rowspan="5">Identity</td><td>Asset Management</td><td>Identify the assets (data, personnel, devices and systems, and facilities) that should be monitored to detect potential cyber threats</td></tr><tr><td>Business Environment</td><td>Understand the organization's mission objectives and the workforce's responsibilities to formulate the detection requirements in the Maritime domain. Identify the roles of the workforce with Maritime Situational Awareness responsibilities that may be impacted by cyber threats</td></tr><tr><td>Governance</td><td>Legal and regulatory cybersecurity obligations are identified to drive the specification of detection requirements. Policies, procedures and processes to monitor communications, detect and manage cybersecurity incidents are specified. Cyber threats detection responsibilities are aligned with internal roles</td></tr><tr><td>Risk Assessment</td><td>The cyber threat landscape in the Maritime domain is identified and will drive the configuration of the detection mechanisms</td></tr><tr><td>Risk Management Strategy</td><td>The criticality of operations that might be affected by a cyber threat should be established and drive the specification of the monitoring, detection and response and recovery strategy</td></tr></tbody></table>

(continued)
<table><caption>**Table 1.** (continued)</caption><thead><tr><th>Function</th><th>Category</th><th>Detection aspects</th></tr></thead><tbody><tr><td>Protect</td><td>Awareness and Training</td><td>Understand the training needs related to detection aspects. Educate personnel, according to their role and their information and security related duties in the Maritime domain. Specify proficiency levels mapped to the workforce's roles to indicate the level of cyber threats detection capabilities that need to be developed per role</td></tr><tr><td rowspan="4">Protect</td><td>Data Security</td><td>Data security requirements (confidentiality, integrity, and availability) should drive the specification of the detection strategy. Decide where to use sensors and detection mechanisms/algorithms to monitor data and identify potential malicious activities, e.g., data exfiltration, data spoofing, etc.</td></tr><tr><td>Information Protection Processes & Procedures</td><td>Security policies, processes and procedures address roles and responsibilities for the collection and evaluation of all the available information from the Maritime IT/OT/ICS sensors and actuators</td></tr><tr><td>Maintenance</td><td>Maintain and repair sensors, services, and components that may be impacted by a cyber threat, to maintain the detection capability</td></tr><tr><td>Protective Technology</td><td>Technical security solutions are managed to ensure the security and resilience of the critical Maritime management systems, like ECDIS, Radars, ICS management system (Machinery Monitoring and Control System). Build onboard/ashore SOCs, install sensors needed for the detection of cyber threats</td></tr><tr><td rowspan="3">Detection</td><td rowspan="3">Anomalies and Events</td><td>Detection of Maritime anomalies caused by exploitation of the Navigational aid's/Surveillance mean's vulnerabilities. Estimation of the potential impact to Maritime operations using of HIDS - NIDS (signature/behavioral based) - XDR (NDR - EDR). Visualization of alerts and development of customized dashboards to communicate results to different stakeholders (e.g., Captain, Navigation Officers, ashore operators) at a strategic, operational and technical level</td></tr><tr><td>Perform analysis of log files from a variety of sources (e.g. individual host logs, network traffic logs, firewall logs, and intrusion detection system logs) to identify possible threats to network/host security</td></tr><tr><td>Use data fusion and algorithms embedded in the Maritime Cyber Situational Awareness infratructure to detect anomalies and malicious activities related to the exploitation of ECDIS, Radar, and AIS vulnerabilities</td></tr></tbody></table>

(continued)
<table><caption>**Table 1.** (continued)</caption><thead><tr><th>Function</th><th>Category</th><th>Detection aspects</th></tr></thead><tbody><tr><td rowspan="2"></td><td>Security Continuous Monitoring</td><td>SOC utilizes tools for behavioural based analysis, including data from data fused sensors, to identify cybersecurity events and verify the effectiveness of the protective measures. Information is monitored from: a) Surveillance and Navigational Sensors (RADAR - AIS - RF receivers - GNSS), b) Industrial Sensors (PLCs) c) Network sensors deployed in relevant positions onboard a ship and ashore, if there is any integration with relative shore systems<br>Utilize host-based sensors (HIDS) and network sensors (NIDS) to monitor: a) the Personnel activity for internal threats, b) the IT/OT/ICS systems, c) unauthorised access of the onboard/ashore systems, d) external service providers activity, e) execution of malicious code f) decoy artifacts and systems, g) exfiltration</td></tr><tr><td>Detection Processes</td><td>Well defined roles and responsibilities are established for the detection of cyber threats onboard a ship and/or ashore against a Maritime infrastructure. For this purpose, detection activities comply with all applicable requirements<br>Detection processes are tested and evaluated with the implementation of relative scenarios<br>Event detection information is communicated to all appropriate parties<br>Detection processes are continuously improved</td></tr><tr><td rowspan="4">Respond</td><td>Response Planning</td><td>Response plan is executed during or after a cyberattack, according to the involved role/responsibility, or the attached compromised or to be compromised system. The secure and safe operational continuity of the Maritime asset is considered as a core requirement</td></tr><tr><td>Communications</td><td>Personnel (crew members) know their roles and procedures during the detection operations</td></tr><tr><td>Analysis</td><td>Generate reports with accurate and comprehensive information about the detected event<br>If the attack is executed onboard a ship, share information about the incident/event with the shore to support decision-making and coordinate further actions</td></tr><tr><td>Mitigation</td><td>Perform actions to mitigate the impact of the attack, ensuring safety and security, collision avoidance, proper maneuver of ships</td></tr><tr><td></td><td>Improvements</td><td>Lessons learned related to the detection activities. Improve detection algorithms, signature and behavior-based rules, to ensure the effectiveness of the detection tools/systems during future attacks</td></tr></tbody></table>

(continued)
<table><caption>**Table 1.** (continued)</caption><thead><tr><th>Function</th><th>Category</th><th>Detection aspects</th></tr></thead><tbody><tr><td rowspan="3">Recover</td><td>Recovery Planning</td><td>Recovery plan is executed during the attack to re-establish functionality of the Network sensors and the Management systems utilized for the Maritime Cyber Situational Awareness</td></tr><tr><td>Improvements</td><td>Lessons learned drive improvements of the recovery measures to ensure the timely restoration of affected operations from future attacks</td></tr><tr><td>Communications</td><td>Repair security communications with shore systems. Recovery activities are communicated to internal stakeholders, including executive and management teams</td></tr></tbody></table>

## 3.3 Maritime Domain Identification

To be able to protect a domain and to detect cyber incidents, one must have a clear view of what the domain entails. Therefore, curricula designers should consider including learning content with regards to the Maritime characteristics. This section highlights the key aspects that should be taken into consideration.

The Maritime domain contains onboard and ashore systems with different operational and behavioral characteristics, considered as the Maritime assets. As presented in Fig. 2, the environment contains ships, which are described as complex mobile platforms, functioning stand alone or interconnected, able to exchange data/information between them and with ashore assets/infrastructures. Ships can be of different types, e.g., cargo, tanker, passenger, fishing etc., including Unmanned Ship Vehicles (USV) or other automated ships. On the other hand, ashore infrastructures can include Maritime operational centers (governmental or private sector's), observation/surveillance posts, and critical infrastructures such as ports or energy transportation facilities (onboard/ashore).

To be able to identify and manage cybersecurity risks, it is essential to identify potential vulnerabilities and the systems involved. The Maritime domain is considered a complex environment, including a range of vulnerable systems, which combine several technologies (IT/OT/ICS) and protocols. As shown in Fig. 2, many hacking positions are available to deploy attacks [13]. For example, a Man-in-The-Middle or a Denial-of-Service (DoS) attack launched against critical OT systems may impact navigation safety; moreover, malwares can cause data manipulation and leakage, impacting severely the Maritime domain's mission objectives [11].

The exposure of the Maritime domain to a range of cyber threats, forced the Maritime industry to develop procedures and capabilities to protect its mission objectives [13], effectively maintaining preparedness, personnel and environmental safety, and operational security. One should also understand the guidelines that create a comprehensive regulative and legislative framework that promotes the identification and management of cyber risks in the Maritime domain: a) BIMCO, in cooperation with many shipowners [15], published guidelines to manage risks onboard ships, considering the NIST Cybersecurity Framework, b) The International Maritime Organization (IMO) adopted resolution MSC 428 (98), to address the cyber risks in existing management systems.
<figure><img src="image_4.png" /><figcaption>Fig. 2. Vulnerable systems onboard ship. Hacking positions onboard/ashore.</figcaption></figure>

Additionally, IMO recommended in a circular MSC-FAL.1/Circ.3, high-level measures to safeguard ships from current cyber threats and vulnerabilities, c) ENISA published guidelines for cyber risk management for ports [16], d) The Advance Bureau of Shipping published guidelines in four key cyber areas: cybersecurity, automated systems safety, data management and software assurance, e) The Digital Container Shipping Association analyzed the Maritime Cyber Risks, based on the NIST Framework, f) The International Association for Classification Societies has issued a “Recommendation on Cyber Resilience (No. 166)” [17], f) The Maritime Bulk Liquids Transfer Cybersecurity Framework Profile [12] which assists in cybersecurity risk assessments for all involved entities. The aforementioned guidelines should be included in prospective trainings to educate participants of the driving factors that formulate cybersecurity requirements, especially relevant to cyber threats detection aspects.

## 3.4 Maritime Cyber Threat Landscape

This section highlights key characteristics of the Maritime cyber threat landscape that need to be taken into consideration when designing a training curriculum. Curricula designers should have a clear view of the knowledge that should be developed to promote a good understanding of the cyber threat landscape and its complexity in the Maritime domain.

The Maritime domain is a complex environment with a range of onboard and onshore assets that need to be protected from cyber threats. The attack surface contains the Maritime IT/OT systems, which operate onboard the ships and/or ashore at the relevant Maritime infrastructures. Part of these systems are integrated with ashore management systems or other systems onboard which are interconnected with other ships, creating an interlinked and complex operational environment. In addition, a range of systems/sensors are connected with Command and Control (C2) management systems. The interactions of the C2 management systems and the sensors/actuators are illustrated in Fig. 3. The
discussion that follows, highlights key operations that need to be protected, and the cyber threats that can jeopardize them. These aspects should be included in prospective training curricula with the aim to educate participants of the assets that can be impacted by cyber threats, understand how the operations and mission objectives can be compromised, and recognize the role that the workforce plays to protect the assets they are working with.

<figure><img src="image_5.png" /><figcaption>Fig. 3. Sensors and management systems (C2) in the maritime domain</figcaption></figure>

The aforementioned C2 management system supports the Maritime domain's mission objectives, and thus it is imperative to identify the cyber threats that are relevant to the systems' operation. Specifically, on a ship, the main management system used to receive fuse and analyse the collected information from the surveillance and navigation sensors is called Electronic Chart and Display Information System (ECDIS). It operates as a plotter providing functionalities for a secure and safe sail. Additionally, the ECDIS collects data from many potentially vulnerable sensors and composes the Maritime picture (or Maritime Situational Awareness/MSA) around the ship. Similarly, a MSA C2 management system, often with extended capabilities in terms of Command, Control, Communications and Computers (C4), operates to ashore centers, capable to collect, process and visualize the data received from the surveillance sensors, mostly from AIS and Radar NMEA. Reported cyberattacks on the sensors are: (1) **AIS:** Spoofing [18], hijacking, data manipulation [19] and DoS [3], executed via software or wirelessly (RF) [20], (2) **Radar:** Jamming, DoS, and obfuscation [8], and (3) **GNSS:** Spoofing [21], DoS [22]. In addition, ECDIS is vulnerable to malware attacks, causing corruption or loss of chart data [23] and positioning spoofing [24].

The other main management system capable to collect and analyse data from the main and auxiliary machines, serving as a Human Machine Interface (HMI), is mostly known as the Machine Monitoring and Control System (MMCS), sometimes also referred as the Ships Management System. In modern ships or ashore infrastructures, the information from sensors/actuations of the industrial systems (e.g., SCADA) is collected through PLCs, which are connected to the MMCS, through industrial switches. The cyber threats related
to the industrial systems of a ship are well covered by the MITRE ATT&CK matrix for ICS. ICS sensors in the Maritime domain include monitoring devices, fuel/oil/water temperature and pressure sensors able to provide indications for the operational status and the performance of the main and auxiliary machines. Additionally, actuators are responsible to modify the operational status of the industrial equipment, according to the sensor's indications. Both of sensors/actuators enlarge the attack surface of the Maritime mean, especially in the case that are interconnected with HMI for remote monitoring and when they have connectivity for automatic operational actions (e.g., on/off mechanisms of the main, power and auxiliaty machines including heater pumps and cooling systems, alerting, automatic indication of capacity, etc.). For the above reasons, these sensors/actuators are referred as Industrial Internet of Things [15].

Moreover, cargo control management systems utilize digital systems to support the loading procedures. Such systems may be connected with various systems onboard, ports, Marine terminals and stevedores. Typical ICS threats that should be considered include, among other, industrial protocols' (e.g., modbus) tree attacks, including gaining unauthorised SCADA system access, identification of modbus devices and general master-slave attacks, and also Denial of Service attacks against the industrial systems and sensors. Other ICS sensors that can increase the attack surface include safety sensors such as fire pumps (eg. CO2, foam, water pumps, tightness indicators).

Safety sensors are also part of the Ships Management System, alongside access control sensors that can protect the personnel and the critical parts of the ship or the environment in general. For example, such devices could include CCTV equipment, access cards, password protected panels, interconnected buoys or lifebuoys, doors status indicators (e.g., preasure), etc. Passengers' access systems also include IoT devices such as in the case of entertaining systems. Many of these sensors are connected to the onboard and/or ashore IT infrastructure for remote monitoring purposes, troubleshooting, etc., and are often considered as Internet of Things (IoT) devices.

As more ICS/IoT devices are introduced onboard/asshore, the attack surface expands further and increases the risk of compromising Maritime operations. It is well known that IoT devices suffer from well-known vulnerabilities, such as insecure passwords, outdated components and unencrypted communications. Therefore, introducing IoT devices should not be taken lightly, and should follow best practices to secure them.

To further analyse the cyber threat landscape in the Maritime domain, the MITRE ATT&CK framework is utilized to develop a blueprint for detecting cyber threats. The purpose of the proposed blueprint is two fold: a) to provide insights to the behavior and techniques that hackers use to exploit the vulnerabilities of the Maritime sensors and actuators, and b) to guide security teams where to focus their detection efforts across the cyberattack kill chain and enhance systems' detection capabilities. Such knowledge is valuable when designing training scenarios as it can provide a clear view to the curricula designers of the malicious activities that can take place across the cyberattack kill chain and assist in selecting topics to cover in the training and build relevant skills and knowledge. For the development of the blueprint, the MITRE ATT&CK Enterprise, ICS and mobile matrices are taken into consideration, as they are widely accepted by the cybersecurity community as a comprehensive resource of adversarial Tactics, Techniques and Procedures (TTP). Therefore, the matrices are a valuable resource to
provide guidance for the identification of relevant attacks against Maritime-related IT and OT systems. Taking this into consideration, this work contributes a Maritime attack matrix (Fig. 4) that combines and customizes information of the MITRE ATT&CK framework attacks, across all matrices, that are applicable in the Maritime domain and clearly identifies the cyber threats related to the Maritime surveillance and navigation systems. The aim is to create a matrix that indicates the cyber threats that can impact the Maritime Navigational and Surveillance Sensors/Systems and the respective Management Console as they are core elements that support the safety and security of Maritime operations. As indicated from the proposed Maritime matrix in Fig. 4, during the:

* Reconnaissance stage, the attacker could gather all the available host and network information, including information about Navigational and Surveillance Systems. Moreover, active scanning can be performed to identify the flow of the NMEA messages, recognizing several Maritime components at the bridge and identifying their connectivity. For example, through active scanning, the ECDIS workstation can be identified, including its connectivity with AIS, Radars, GNSS and possibly with other navigation sensors.

* Resource development, all the necessary infrastructure is prepared to facilitate the execution of attacks using RF links/wired connections, using malware or exploits.

* Initial access, techniques can be implemented to compromise the network devices and peripherals (including the satellite communications equipment), RF ship-to-ship or ship-to-shore connections and vulnerable RF surveillance sensors. Especially for the ship, VSATand RF links are the main access points.

* Execution, several techniques can be deployed to manipulate Maritime data (NMEA Radar/GNSS/AIS) and change the operational status of the Maritime OT devices/systems.

* Percistence stage, the attacker could modify configuration files or the settings to the receivers of the Navigation and Surveillance systems in order to maintain access.

* Privilege escalation, techniques similar to the other MITRE ATT&CK matrices can be implemented, which are applicable for Maritime OT systems.

* Defence escalation, the attacker can take advantage of Maritime/navigational messages that are transmitted in plain text and implement spoofing techniques.

* Discovery, the target is to identify the navigation and surveillance devices and the data flow among them.

* Lateral movement, remote access techniques and direct connectivity (e.g., via USB stick) are feasible, taking advantage of the enhanced connectivity between sensors and management systems.

* Collection, the target is to capture the Maritime traffic which is exchanged between the bridge components.

* Command and control, the attacker is capable to mimic the ship's bridge network using techniques to connect the ship's surveillance sensors with the attacker's C2 system, e.g., attacker's ECDIS.

* Exfiltration, the attacker can apply techniques to exfiltrate NMEA (Radar/AIS/GNSS) data.

* Impact, the results of an attack against Maritime OT systems are described, causing manipulation of the Maritime Picture, Denial of Service and/or loss of availability and control.
## 3.5 Cybersecurity-Aware Maritime Roles and Cyber Threats Detection Capabilities Development

In the Maritime environment, human roles are separated in three main categories: managers/commanding officers, officers/directors and employees/operators with different roles and responsibilities. The detection of cyber threats in the Maritime domain is an aspect that concerns all stakeholders, including those that have IT/cybersecurity responsibilities and those that have a managerial role onboard a ship and/or ashore. For example, a weaponized cyberattack might affect the movement/behavior of the ship and result into a collision. Therefore, a ship's IT Manager (as a key person) should have clear understanding of both Maritime and cyber domains to ensure the safety of a ship. To be able to support the mission objectives of the organization [12], all involved stakeholders need to develop capabilities to detect potential cybersecurity incidents that can impact decision-making. The only difference is the level of knowledge and skills they need to develop to support their role. The key Maritime roles [15] to consider in potential trainings include the Managing director, the Fleet manager, the Captain/Commanding officer, the organizations' and the ships' IT Managers, the Chief engineer, the Navigation/Operation officer, the Operators, the Safety manager and the Training manager.

To design effective training programs, a microlearning approach is required to build human capacity in detecting cyber threats in the Maritime domain. To achieve this, an initial set of baseline cyber threats detection capabilities should be utilized to guide the development of essential capabilities. It is envisioned that once the workforce develops these essential capabilities, then further training can be pursued to build more advanced skills and knowledge. This work specifies a set of 10 essential capabilities that can be considered in training curricula. Table 2 lists key capabilities that need to be developed across strategic/operational/technical levels to support detection objectives [15]. The proposed capabilities take into consideration the guidelines in [25] and the key aspects of NIST Cybersecurity Framework that have taken a center stage in this work and served as drivers to specify the baseline capabilities listed in Table 2. Specifically, the workforce first needs to understand the Maritime domain, identify its key assets and the relevant cyber threats that can impact their operation. Special attention should be given to educating the workforce about cyber threats that can jeopardize the operation of onboard assets and can lead to severe impact, e.g., ship collision.

* Another essential skill that needs to be cultivated concerns the workforce's communication skills. During an incident, the workforce should be able to communicate information effectively and efficiently to the appropriate stakeholders. This is critical for timely resolving an incident with the minimum impact. This aspect should be driven by an appropriate detection, response, and recovery policy, which can be considered a fundamental element to achieve governance. Therefore, appropriate capabilities should be developed with regards to the design and development of such policy. To be better prepared and be able to detect an incident effectively and efficiently, personnel should reference multiple intelligence sources across the cybersecurity and Maritime domains and retrieve information about relevant threat actors, their capabilities, attack indicators, etc. Such knowledge can further be utilized to configure security systems, e.g., SIEM. Building technical capabilities are also part of the proposed baseline
<table><caption>Fig. 4. Maritime attack matrix</caption><thead><tr><th>Reconnaissance</th><th>Resource Development</th><th>Initial Access</th><th>Execution</th><th>Persistence</th><th>Privilege Escalation</th><th>Defense Evasion</th><th>Discovery</th><th>Lateral Movement</th><th>Collection</th><th>Command and Control</th><th>Exfiltration</th><th>Impact</th></tr></thead><tbody><tr><td>Active Scanning for NMEA Mags</td><td>Acquire Infrastructure to receive and maliciously transmit RF signals</td><td>Drive-by Compromise the Navigational and Surveillance System's</td><td>Broadcast receivers NMEA Traffic/ Falsified AIS messages</td><td>Broadcast receivers</td><td>Exploitation for Privilege Escalation</td><td>Masquerade Legitimate Application/ Service</td><td>Navigational and Surveillance Management Account Discovery</td><td>Exploitation of Remote Services</td><td>Capture NMEA traffic</td><td>Commonly Used Port</td><td>AIS/GNSS/ Radar NMEA/ Replay Attack</td><td>Denial of Service</td></tr><tr><td>Gaither Victim Network and Host Information relative to Management System's Surveillance equipment</td><td>Compromise Accounts relative to Management System's</td><td>Deliver Malware on ECDIS, Map User Interface app, via other Monitors or Removable Devices</td><td>Command-Line Interface</td><td>Modify configuration of the Navigational aid, or the Surveillance System</td><td>Process Injection</td><td>Modify Trusted Navigation and Surveillance Data</td><td>Tracking of the Ship</td><td>Attack via the ECDIS Plotters via USB connection</td><td>Man in the Middle</td><td>Connection Proxy</td><td>Ghost ship attack</td><td>Loss of Control</td></tr><tr><td>Gaither Victim Ship/Maritime Infrastructure Information for the existing relationships</td><td>Compromise Infrastructure</td><td>Exploitation of Remote Services</td><td>Scripting to manipulate NMEA traffic</td><td>Port Knocking</td><td>Valid Accounts</td><td>Obfuscate Files or Information</td><td>Network Stuffing</td><td></td><td>Between Seniors and C2 Systems</td><td>Standard Application Layer Protocol</td><td>Block Serial COM</td><td>Denial of View</td></tr><tr><td>Search for integration between Ship to Ship or Ship to shore</td><td>Develop Capabilities using Malware and Exploit</td><td>Compromise VPN connection</td><td>Modify Services status</td><td></td><td></td><td></td><td></td><td></td><td></td><td>Input Capture GUI Input Capture, Keylogging, Credential API</td><td></td><td></td></tr><tr><td rowspan="2">NMEA related Attacks</td><td rowspan="2">Obtain Capabilities using Malware, Tools, Exploit, vulnerabilities, Certificates</td><td rowspan="2">Exploit via SDR RF Interfaces</td><td rowspan="2"></td><td rowspan="2"></td><td rowspan="2"></td><td rowspan="2"></td><td rowspan="2"></td><td rowspan="2"></td><td rowspan="2"></td><td rowspan="2">Data Obfuscation</td><td>Block Reporting Message</td><td>Loss of Availability</td></tr><tr><td>Maquarade Legitimate Application Service</td><td>Non-Standard Port</td><td>Denial of Service</td><td>Loss of Safety</td></tr><tr><td></td><td>Deliver GNSS/AIS NMEA Spoofed Messages to Surveillance Receivers/Systems</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td>Create Maritime Anomaly</td><td>Manipulation of Control</td><td>Manipulation of MSA</td></tr></tbody></table>
set. An essential capability concerns analyzing logs from different sensors to iden-
tify potential malicious activities. Considering that cyber threats increase in intensity
and complexity, searching effectively through logs becomes challenging. Therefore,
taking into consideration the onboard/onshore assets that need protection, alongside
threat intelligence information and the various logs collected from sensors, the capa-
bility to construct basic to advanced log queries should be developed to address the
dynamics of the cyber threat landscape. Having a clear view of the attack stage,
whether the attack is at an initial stage, or it is already elaborated and has impacted
Maritime operations, can assist decision-makers to prioritize actions. Therefore, it is
imperative for the appropriate personnel to have the knowledge and the skills to map
the security incident to the cyberattack kill chain. All the aforementioned information
should be synthesized and communicated through appropriate dashboards to differ-
ent stakeholders working at a strategic, operational, or technical level. The aim is to
present relevant information related to security events and incidents to the appropri-
ate decision-makers, supporting them in their tasks to detect malicious activities and
recover from compromization. Depending on the workforce's role, dashboards can
be designed to present strategic, to operational, to technical level details. The goal
is to build a cyber resilience capacity, where the workforce recognizes its working
environment, realizes and anticipates the threat, identifies security incidents, and also
plans and applies a response when required.

Curricula designers can select the proposed baseline set as a whole or they can select
a subset of the proposed capabilities and build a training curriculum. The capabilities
list is not meant to be exhaustive, but rather indicative, aiming to serve as a starting point
that can be further elaborated depending on the training needs, the personnel's role, and
the proficiency level that detection capabilities need to be demonstrated by personnel.

4 Cyber Threats Detection Training Activity

This section presents a training activity that was developed over a Maritime Cyber
Range [13] with the target to develop cyber threats detection capabilities. First, the high-
level architecture of the training platform, which is appropriate to deliver the activity
is presented, and then the design aspects of the training activity are discussed. The
discussion also indicates how the proposed framework was utilized to drive the design
and development of the training activity.

## 4.1 Training Platform – High-Level Architecture

To be able to deliver training activities and build cyber threats detection capabilities, an appropriate learning environment needs to be developed. In the context of authors’ research activities, a Maritime Cyber Range [13] was developed to simulate realistic cyber threat scenarios and to deliver offensive and defensive training activities in the Maritime domain. As part of the training infrastructure, a Security Operations Centre (SOC) was developed to support continuous security monitoring of Maritime operations. Table 1 was consulted to identify the aspects that need to be taken into consideration
<table><caption>**Table 2.** Cyber threats detection capabilities in the Maritime domain</caption><thead><tr><td>ID</td><td>CAPABILITIES</td><td>LEVEL</td></tr></thead><tbody><tr><td>C1</td><td>Identify onboard/onshore assets that can be impacted by cyber threats</td><td>S/O/T</td></tr><tr><td>C2</td><td>Discuss the Maritime attack surface and the impact to the operations and mission objectives of the organization</td><td>S/O/T</td></tr><tr><td>C3</td><td>Explain how specific cybersecurity threats may compromise the operation of onboard assets</td><td>S/O/T</td></tr><tr><td>C4</td><td>Communicate information about an onboard security incident to the appropriate stakeholders</td><td>S/O/T</td></tr><tr><td>C5</td><td>Design and implement a detection, response and recovery policy taking into consideration the organizations' mission objectives, regulations, and best practices</td><td>S/O/T</td></tr><tr><td>C6</td><td>Utilize multiple intelligence sources across the cybersecurity and Maritime domains to detect a security incident</td><td>O/T</td></tr><tr><td>C7</td><td>Construct search queries to tailor log analysis considering onboard/onshore assets</td><td>T</td></tr><tr><td>C8</td><td>Map Maritime security incidents to the cyberattack kill chain to identify the stage of the attack and inform decision-making</td><td>T</td></tr><tr><td>C9</td><td>Detect a security incident and take actions to eliminate the impact to the onboard/onshore assets</td><td>O/T</td></tr><tr><td>C10</td><td>Development of customized dashboards to communicate results to different stakeholders at a strategic, operational, and technical level</td><td>T</td></tr></tbody></table>

Level: S – Strategic, O – Operational, T – Technical.

when developing a SOC within the Maritime Cyber Range. Specifically, the tasks listed under the Detection function in Table 1 have been taken into consideration, driving the decisions taken related to the technologies utilized and the implementation aspects. This section outlines the high-level architecture (Fig. 5) of the developed training platform to enable curriculum designers to gain an understanding of potential learning environments they need to develop to support learning objectives related to detection aspects.

As depicted in Fig. 5, the developed training platform leverages the abilities of already deployed technologies to detect cyber threats, including End Point Detection and Response (EDR), Host and Network Intrusion Detection and Prevention Systems (H/NID) and Security Information Event Management Systems (SIEM). HIDS provide the capability to detect host-based malicious activity, where NIDS provide detection of malicious, spoofed, or manipulated traffic. Expanded capabilities of the SIEM to visualize a cyber incident impacting the Maritime traffic are developed as part of the training platform. Also, it is recommended that the detection capabilities and alerting should remain onboard the ship, since the connection with the shore is not ensured.

As indicated in Table 1, to develop continuous and effective security monitoring, sensors should be deployed at appropriate network positions to collect the IT and OT network traffic. Endpoints and network sensors are deployed in each network segment.
<figure><img src="image_6.png" /><figcaption>**Fig. 5.** High-level description of a maritime cyber threat detection training platform</figcaption></figure>

As illustrated in Fig. 5, the deployment of network sensors provides the capability to collect, monitor, and analyze the traffic exchanged between sensors/actuators and the respective Maritime management systems. The traffic monitoring process is also useful in case a system is integrated through a ship to shore connection. By default, the architecture of the training platform permits the deployment of training scenarios considering onboard/ashore infrastructures.

With regards to the implemented detection mechanisms, signature and behavior anomaly detection capabilities can be effective when sophisticated attacks are executed. In particular, the training activity described in Sect. 4.3 considers an AIS “Replay Attack” on ECDIS, in combination with a Man-in-the-Middle (MiTM) technique and malware deployment. The detection of the attack is performed using a SIEM, configured with an appropriate behavior-based rule/query to detect the event when the port is killed. Figure 6 indicates Zeek’s rule for the detection of the AIS replay attack. Moreover, this attack can be detected by a command-and-control system, which is able to apply fusion algorithms to correlate the received AIS messages with the detected RF signals. As a result, the system can realize the spoofed tracks.

Taking into consideration the proposed Maritime Cyber Threat Detection Framework to design a new training activity, Sect. 4.2 presents the activity, alongside the learning strategy to engage participants and achieve an effective training. Details of the attack scenario are presented in Sect. 4.3.

## 4.2 Description of Training Activity

The motivation behind the development of the training activity was to start building structured capabilities related to cyber threats detection to create human capacity in the Maritime domain. Initially, Sect. 3.5 was consulted to decide on the capabilities to develop through the training activity. Table 2 was referenced to facilitate the selection. Capabilities C1–C3 and C7–C8 have been selected as the initial aim was for all
<figure><img src="image_7.png" /><figcaption>Fig. 6. Zeek's rule for the detection of AIS replay attack</figcaption></figure>

stakeholders to develop a good understanding of the cyber threat landscape and realize the significance of the problem and how it can affect Maritime operations. Such knowledge should be developed across the workforce with strategic, operational, and/or technical roles. Moreover, it was considered essential for participants to be able to identify the stage of the attack and realize the importance of communicating information to decision-makers to coordinate further actions before an attack can elaborate further.

Taking into consideration the cyber threat landscape presented in Sect. 3.4 and the increased interest of cyber criminals to attack onboard systems, it was decided to focus the training activity on a relevant attack impacting critical onboard systems. The training activity presents a case study, demonstrating an attack scenario, and critically analyzing its execution. The attack scenario covers the exploitation of a vulnerability related to AIS, impacting the Maritime OT system called ECDIS. Through the demonstration of the scenario and the critical analysis, the participants are expected to identify critical bridge systems (C1), such as AIS, radar, GNSS and ECDIS, that can be affected by a potential cyber threat, and discuss their connectivity needs/dependencies. Moreover, participants are expected to analyze their operational use and how their operation may be affected (C2) from specific cybersecurity threats (C3). Special emphasis is given to ECDIS operation as it is the primary system to construct MSA. The training activity also aims to build capabilities related to identifying the stage of the attack (C8) and to communicating information to the relevant decision-makers before the attack is elaborated down the cyberattack kill chain and cause greater impact. The attack mechanisms will be demonstrated and critically discussed to facilitate understanding and learning. Beyond gaining knowledge and developing critical thinking related to the cyber threat landscape and its impact to Maritime operations, it is considered equally important to demonstrate aspects of the network monitoring capabilities that need to be developed
(C7). The focus will be to develop understand around the appropriate use of sensors in the Maritime domain to detect a cyber threat and to critically analyze the difference between a cyber incident and a Maritime anomaly, and how they may be related and detected.

## 4.3 Cyber Threats Attack Scenario

The attack scenario to be demonstrated as part of the training activity, covers the exploitation of a vulnerability related to AIS, impacting ECDIS. The specific vulnerability, which permits the manipulation of AIS messages as they are exchanged in plain text, provide the capability to demonstrate operational scenarios impacting the Maritime Situational Awareness (MSA) both in a ship and/or in an ashore Maritime infrastructure. The proposed Maritime matrix in Sect. 3.4 is referenced to select the techniques to implement in the context of the training scenario. Figure 7 indicates the techniques utilized from the Maritime matrix and maps them to the cybersecurity kill chain.

<figure><img src="image_8.png" /><figcaption>Fig. 7. Attack scenario mapped to the maritime matrix</figcaption></figure>

The steps below describe the attack evolution as implemented in the training platform.
* Step 1: The attacker successfully infects the target machine (ECDIS workstation) through a malicious Electronic Chart's (ENC) update and setups a MiTM attack controlling the traffic between AIS and ECDIS.

* Step 2: Attacker compromises the ECDIS through the existing TCP/IP port utilized to receive the AIS Traffic.

* Step 3: The attacker who previously captured the preferable AIS situation (AIVDM/AIVDO messages) regarding the area of interest and used dispatcher to decode these messages, spoofs part of the messages by replaying the AIS tracks (the attacker also manipulates the timestamp of the messages and stores them in a file).

* Step 4: Through the compromised ECDIS, the falsified/spoofed messages are retransmitted to ECDIS when the ship enters a specific circular area (Latitude - Longitude). As a result, the attacker modifies the MSA of the ship with the insertion of spoofed AIS messages to ECDIS.

Depending on the objectives of training activities, the proposed Maritime attack matrix can be utilized in a similar approach to guide the development of new cyberattack scenarios supporting offensive and/or defensive tasks.

## 5 Conclusion

Successful detection of cyber threats in the Maritime domain is critical for uninterrupted Maritime operations. Developing detection capabilities can mitigate the impact of cyber threats, support decision making and maintain the security and safety of the ships and/or the shore Maritime infrastructures. This work contributed towards a new framework to assist the development of (a) relevant Maritime cybersecurity skills and (b) cyber threats detection capabilities for the Maritime domain, including a novel Maritime attacks matrix based on MITRE ATT&CK matrices. Future work will include the delivery of the training activity and the design of new curricula using the proposed framework.

**Acknowledgement.** The authors would like to acknowledge the FORESIGHT project funded by the European Union's Horizon 2020 research and innovation program (grant agreement: 833673), and the partners on the project.

## References

1. Meland, P.H., Bernsmed, K., Wille, E., Rødseth, Ø., Nesheim, D.A.: A retrospective analysis of maritime cyber security incidents. TransNav Int. J. Mar. Navig. Saf. Sea Transp. **15**(3) (2021)

2. Hyra, B.: Analyzing the attack surface of ships, p. 166 (2019)

3. Caprolu, M., Pietro, R.D., Raponi, S., Sciancalepore, S., Tedeschi, P.: Vessels cybersecurity: issues, challenges, and the road ahead. IEEE Commun. Mag. **58**(6), 90–96 (2020). https://doi.org/10.1109/MCOM.001.1900632

4. Satellite Internet Market: Global Industry Analysis and Forecast 2021–2027: by Frequency Band, Bandwidth, Orbit, End User and Region. Maximize Market Research. https://www.maximizemarketresearch.com/market-report/satellite-internet-market/125907/. Accessed 30 Jan 2022
5. Jacq, O., Brosset, D., Kermarrec, Y., Simonin, J.: Cyber attacks real time detection: towards a cyber situational awareness for naval systems. In: 2019 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (Cyber SA), pp. 1–2, June 2019. https://doi.org/10.1109/CyberSA.2019.8899351

6. Jacq, O., Boudvin, X., Brosset, D., Kermarrec, Y., Simonin, J.: Detecting and hunting cyberthreats in a maritime environment: specification and experimentation of a maritime cybersecurity operations centre. In: 2018 2nd Cyber Security in Networking Conference (CSNet), pp. 1–8, October 2018. https://doi.org/10.1109/CSNET.2018.8602669

7. Canepa, M., Ballini, F., Dalaklis, D., Vakili, S.: Assessing the effectiveness of cybersecurity training and raising awareness within the maritime domain. In: Online Conference, pp. 3489–3499, March 2021. https://doi.org/10.21125/inted.2021.0726

8. Tam, K., Jones, K.: MaCRA: a model-based framework for maritime cyber-risk assessment. WMU J. Marit. Aff. **18**(1), 129–163 (2019). https://doi.org/10.1007/s13437-019-00162-2

9. Hatzivasilis, G.: Modern aspects of cyber-security training and continuous adaptation of programmes to trainees. Appl. Sci. **10**(16) (2020). https://doi.org/10.3390/app10165702

10. Hopcraft, R.: Developing maritime digital competencies. IEEE Commun. Stan. Mag. **5**(3), 12–18 (2021). https://doi.org/10.1109/MCOMSTD.101.2000073

11. Mraković, I., Vojinović, R.: Maritime cyber security analysis – how to reduce threats? Trans. Marit. Sci. **08**(01), 132–139 (2019). https://doi.org/10.7225/toms.v08.n01.013

12. Maritime Bulk Liquids Transfer Cybersecurity Framework Profile. United States. Coast Guard. https://www.hsdl.org/?abstract&did=797741. Accessed 12 Feb 2022

13. Potamos, G., Peratikou, A., Stavrou, S.: Towards a maritime cyber range training environment. In: 2021 IEEE International Conference on Cyber Security and Resilience (CSR), pp. 180–185, July 2021. https://doi.org/10.1109/CSR51186.2021.9527904

14. Tam, K., Moara-Nkwe, K., Jones, K.: The use of cyber ranges in the maritime context: assessing maritime-cyber risks, raising awareness, and providing training. Marit. Technol. Res. **3**(1) (2020). https://doi.org/10.33175/mtr.2021.241410

15. The Guidelines on Cyber Security Onboard Ships. https://www.bimco.org/about-us-and-our-members/publications/the-guidelines-on-cyber-security-onboard-ships. Accessed 23 Oct 2021

16. European Union Agency for Cybersecurity. Cyber risk management for ports: guidelines for cyber security in the maritime sector. LU: Publications Office (2020). https://data.europa.eu/doi/10.2824/671060. Accessed 11 Feb 2022

17. Armando, A., Henauer, M., Rigoni, A.: Next Generation CERTs. IOS Press (2019)

18. Balduzzi, M., Pasta, A., Wilhoit, K.: A security evaluation of AIS automated identification system. In: Proceedings of the 30th Annual Computer Security Applications Conference, New Orleans Louisiana USA, pp. 436–445, December 2014. https://doi.org/10.1145/2664243.2664257

19. Ray, C., Gallen, R., Iphar, C., Napoli, A., Bouju, A.: DeAIS project: detection of AIS spoofing and resulting risks. In: OCEANS 2015 - Genova, pp. 1–6, May 2015. https://doi.org/10.1109/OCEANS-Genova.2015.7271729

20. Faragher, R., MacDoran, P.F., Mathews, M.B.: Spoofing mitigation, robust collision avoidance, and opportunistic receiver localisation using a new signal processing scheme for ADS-B or AIS, p. 11 (2014)

21. Hareide, O.S., Jøsok, Ø., Lund, M.S., Ostnes, R., Helkala, K.: Enhancing navigator competence by demonstrating maritime cyber security. J. Navig. **71**(5), 1025–1039 (2018). https://doi.org/10.1017/S0373463318000164

22. DiRenzo, J., Goward, D.A., Roberts, F.S.: The little-known challenge of maritime cyber security. In: 2015 6th International Conference on Information, Intelligence, Systems and Applications (IISA), Corfu, Greece, pp. 1–5, July 2015. https://doi.org/10.1109/IISA.2015.7388071
23. Preparing for Cyber Battleships – Electronic Chart Display and Information System Security

24. Svilicic, B., Brčić, D., Žuškin, S., Kalebić, D.: Raising awareness on cyber security of ECDIS. TransNav Int. J. Mar. Navig. Saf. Sea Transp. **13**(1) (2019). https://doi.org/10.12716/1001.13.01.24

25. Parrish, A.S., et al.: Global perspectives on cybersecurity education for 2030: a case for a meta-discipline. ITiCSE (2018). https://doi.org/10.1145/3293881.3295778