# Comprehensive Analysis of Maritime Cybersecurity Landscape Based on the NIST CSF v2.0
## 5 NIST CSF-Based Analysis of Maritime Cybersecurity
### Detect
#### 5.4.2 Adverse Event Analysis  
The adverse event analysis category under the NIST CSF v2.0 plays a critical role in identifying, managing, and mitigating cybersecurity risks in various sectors, including the maritime sector. This category focuses on detecting unusual activity that could potentially signify a cybersecurity threat within a system or network. Considering the maritime industry's heavy reliance on technology and interconnected systems, applying the principles of this category to detect irregularities and events is crucial.  
Research on maritime cybersecurity is diverse, addressing various vulnerabilities and providing innovative solutions. [PERSON] et al. [117] investigated anomalies related to Estonian shipowners, emphasizing the need for better staff education on cybersecurity. Meanwhile, other researchers such as [PERSON] et al. [118] have focused on Programmable Logic Controller (PLC) and SCADA system vulnerabilities, revealing the challenges in investigating onboard system security. Another important area of research includes the vulnerabilities brought about by autonomous ships and IoT systems. In this context, [PERSON] et al. [119] revealed weaknesses in the Automatic Identification System (AIS) at Huston port.  
Research on ways to fortify communication systems has been pivotal as well. [PERSON], [PERSON] et al. [69] exposed the major weaknesses in maritime communication systems and proposed solutions based on the MITRE ATT&CK framework. Similarly, [PERSON] et al. [120] highlighted the potential of 5G technology in bolstering cybersecurity in the maritime sector. To tackle emerging threats, a systematic approach to analyzing NMEA navigation messages was proposed that aimed to develop an NMEA intrusion detection system [121].  
Optimizing data flows and handling anomalies in maritime vessel systems has been another focus. [PERSON] et al. [90] introduced a genetic algorithm-based ANN classifier (GA-ANN) for this purpose. Underscoring the threat of rootkit attack variants, research by [PERSON] et al. [92] shed light on the need for vigilance in monitoring shipboard power systems. Leveraging machine learning, [PERSON] et al. and [PERSON] et al. [94,122] respectively highlighted the importance of early detection and identification of potential anomalous activities in radar communication and drones in critical infrastructure.  
Furthermore, addressing the challenge of malicious web shells in Maritime Intelligent Transport Systems (MITS), [PERSON] et al. [123] proposed a high-accuracy hybrid detection method. Together, these research efforts represent substantial progress in enhancing maritime cybersecurity, establishing a strong foundation for future research and policy-making.  
Additionally, comprehensive research conducted by [PERSON] et al. [124] addressed cybersecurity threats in the Maritime Transportation Systems (MTS) stemming from IoT data processing. They proposed an Intrusion Detection System (IDS) model based on a Convolutional Neural Network-Multilayer Perception (CNN-MLP) trained through federated learning, thereby reinforcing detection processes without compromising privacy.