# Enhancing Unmanned Marine Vehicle Security: A Periodic Watermark-Based Detection of Replay Attacks
## 4 Numerical Simulation
** Setting the watermark signal at \(\Sigma_{o}=0.5763\), data are recorded by the attacker from 30 to 40 s. As illustrated in Figure 11 (left figure), the UMVs undergo replay attacks from 620 to 660 s, 700 to 740 s, 780 to 820 s, 860 to 900 s, and 940 to 980 s. Similarly, as shown in Figure 11 (right figure), replay attacks occur from 620 to 710 s, 750 to 840 s, and 880 to 970 s. This case study aims to test the strategy's effectiveness in detecting prolonged continuous replay attacks. Detection effectiveness of the UMVs system under replay attacks, as demonstrated for both continuous and discontinuous types of replay attacks using the method proposed, is showcased in **Case 1** and **Case 2**. In **Case 1**, the UMVs underwent continuous replay attacks of two different durations during regular operations. As Figure 10 indicates, during normal system operation, \(G(k)=0\). However, when the UMVs are undergoing a replay attack, \begin{table}
\begin{tabular}{c c c c} \hline \(T\) & \(\Sigma_{o}\) & \(\beta\) **of Continuous Replay Attacks** & \(\beta\) **of Discontinuous Replay Attacks** \\ \hline
6 & 0.5763 & 92.5\% & 87.3\% \\
8 & 0.5763 & 92.7\% & 88.4\% \\
10 & 0.5763 & 93.8\% & 90.1\% \\
12 & 0.5763 & 93.3\% & 89.2\% \\
14 & 0.5763 & 89.6\% & 87.5\% \\ \hline \end{tabular}
\end{table} 
Table 2: Detection Rates of Replay Attacks under Different Watermark Periods  
Figure 8: \(G(k)\) for UMVs with different watermark signal variances in the absence of noise. Figure 9: \(G(k)\) for UMVs with different watermark signal variances in the presence of noise. significant changes occur in the values of the detection function. Between 650 and 750 s, \(G(k)\
eq 0\), indicating that the UMVs are experiencing a replay attack. In **Case 2**, the UMVs underwent several brief intermittent replay attacks. As displayed in Figure 11, the system faced five short, discontinuous attacks and two additional quick, intermittent ones. Similar to **Case 1**, with the application of the proposed strategy, the detection function maintains \(G(k)=0\) during normal operations. Notable shifts in detection function values when under attack suggest a replay attack is occurring. After repeating experiments 1000 times, the detection rates for continuous and discontinuous replay attacks are \(\beta=93.8\%\) and \(\beta=90.1\%\), respectively, with false positive rates of \(\alpha=4.5\%\) and \(\alpha=6.7\%\). Thus, the method proposed in this article effectively detects the occurrence of continuous with discontinuous replay attacks of UMV systems. As shown in Figure 12, in order to further validate the effectiveness of the proposed method, a comparative analysis is performed to compare the control performance of the proposed method with that of the method outlined in [30; 36; 37]. Simulations were conducted for 200 iterations on four approaches to obtain the average performance degradation and detection rates under replay attacks. It can be observed from Figure 12 that as the detection rate increases, the performance degradation of different methods gradually increases. This analysis underscores the superiority of the proposed method by comparing various metrics, including the continuous replay attack detection rate \(\beta_{1}\), discontinuous replay attack detection rate \(\beta_{2}\), continuous replay attack false alarm rate \(\alpha_{1}\), discontinuous replay attack false alarm rate \(\alpha_{2}\), and the average control cost under multiple attacks \(J_{ave}\), with those reported in previous studies [30; 31; 32; 36; 37]. The results of this comparative analysis are presented in Tables 3 and 4.