## 5 Results and Discussion
### RQ1: What Cyber-Attacks in the MSCN Have Been Reported in the Academic Literature?
#### 5.1.1 Cyber-Attacks in the MSCN  
DoS/DDoS: These attacks are predominant threats in the MSCN, where attackers overwhelm systems with excessive traffic, resulting in denial of access to online services [42; 43; 44]. The threats extend from underwater sensor networks, where bandwidth vulnerabilities are exploited [45; 46] to IoT devices used across maritime operations [47; 48]. DDoS attacks are particularly notable for their impact on port operations, revealing vulnerabilities in cyber risk assessments [49; 50; 51]. Additionally, DDoS threats affect maritime vessel networks, with critical implications for systems such as the AIS, in which approximately 89% of setups are susceptible at the protocol level [52; 53; 54]. These insights highlight the urgent need for robust cybersecurity defenses across maritime systems to mitigate the widespread risk of DoS/DDoS attacks. Malware, ransomware, and Trojans: Research demonstrates that these cyber risks have a substantial influence on multiple aspects of maritime operations, including port infrastructures and onboard systems such as SCADA. Studies have highlighted vulnerabilities in programming logic controllers and the risks associated with insufficient antivirus protection, underscoring the importance of implementing strong cybersecurity measures [47; 50; 55; 56]. Comprehensive strategies are essential, as evidenced by a risk  
Figure 4: Proportion of papers according to the MSCN actor. assessment conducted in Turkey's Marmara Region container port, which showed medium vulnerability levels to malware attacks [49; 56]. Experts argue in favor of implementing strict security measures and global standards to protect vessel management systems and counteract malware-induced disruptions [15; 57; 58]. This collective evidence underscores the complex challenge malware poses across the MSCN, necessitating enhanced defenses and standardized cybersecurity frameworks [42; 59]. Social engineering, tampering, phishing, and spear phishing: Human vulnerabilities are of utmost importance in maritime cybersecurity because they are exploited through techniques such as phishing, spear phishing, and social engineering to compromise security systems. Cybercriminals frequently employ false emails to obtain sensitive information or lure employees into breaching security protocols through social media interactions [15; 56; 60]. In addition, manipulating system assets such as disks and networks has substantial dangers, especially for vital systems such as the AIS, which requires strict data security procedures [61]. Port operators and shipping lines are particularly vulnerable to these cyber-attacks, emphasizing the necessity for comprehensive cybersecurity policies that consider human aspects to safeguard all entities within the MSCN [50; 62; 63]. In this paper, social engineering, tampering, phishing, and spear phishing are grouped due to their common exploitation of human vulnerabilities. These methods manipulate individuals to circumvent security, often through deceptive communications or insider threats. The taxonomy underscores the importance of addressing human factors in cybersecurity, as these vectors exploit human error, not just technical flaws. As the industry digitizes, comprehensive defenses must include technical measures in addition to awareness and training to effectively mitigate these risks. Brute force, identity fraud, watering hole, and port scanning: These less commonly acknowledged yet serious cyber dangers impact all MSCN agents. The grouping of brute force, identity fraud, watering hole, and port scanning is based on their common goal of exploiting system access points to gain unauthorized access or information within the MSCN. These methods target different aspects of network security but are unified by their focus on identifying and exploiting vulnerabilities. Brute force attacks systematically attempt different combinations of passwords, whereas identity fraud is the theft of identities for illicit purposes [64; 65].