## 2 Materials and Methods
### Multi-Criteria Decision Analysis (MCDA)
#### 2.3.1 Set of Criteria  
The ship assessment model was based on relevant criteria. These criteria constitute a coherent set that describes the ship and its behavior. The authors considered parameters that could signal anomalies, arouse suspicion, or point to potentially abnormal behavior of the vessel within the designated waterway. The criteria set consists of eight individual criteria: C1, change in speed; C2, change in course; C3, breach of navigational rules; C4, invalid destination details; C5, suspicious navigational status; C6, AIS signal fading; C7, registers; and C8, databases. The individual criteria are grouped into categories and clusters, forming a three-level structure (Figure 3). Two clusters have been defined as follows: parameters related to the ship's behavior and its official status. The first cluster includes three groups: movement data, compliance with traffic rules, and proper signal transmission. The second cluster includes a group containing ship registers. The characteristics of the criteria and the evaluation method for the ships are presented below. A sudden and significant reduction in speed (C1) is usually an important indicator that the ship intends to maneuver. In the context of an attempt to damage underwater infrastructure, low speeds or stopping the vessel is necessary in order to drop the anchor. Figure 3: Hierarchy of criteria. Due to its size and weight, the anchor can be used to hook onto submarine cables. The weight of this criterion was set at 25%. The same applies to course changes (C2). Large course changes are observed during various ship maneuvers (e.g., approaching a waypoint or deploying fishing gear). This type of behavior depends on the type of vessel; however, if it occurs near underwater infrastructure, it can serve as a warning signal. When observing streams of vessels navigating along established routes, noticeable deviations from these paths may raise suspicion. The weight of this criterion was set at 15%. Criterion C3 (navigational rule breaching) examines the ship's behavior in relation to the traffic regulations in force within a given body of water. There may be a fixed direction of navigation, or certain areas may be designated as restricted (e.g., wind farms). Non-compliance with these rules is always a cause for concern. The weight of this criterion was set at 15%. The operator of the vessel's AIS is expected to enter information about the ship's destination (C4). However, this information is often outdated or intentionally omitted. In the context of underwater infrastructure sabotage, this may be considered suspicious. The weight of this criterion was set at 5%. In accordance with the COLREGs (Convention on the International Regulations for Preventing Collisions at Sea), vessels communicate their navigational status (C5) through the use of navigation lights (e.g., underway, at anchor, not under command). This status is also reflected in the automatic identification system. Any change in navigational status may influence the behavior of other vessels in the vicinity, as it implies specific rights and obligations under maritime traffic regulations. However, there exists the potential for misuse of this mechanism, whereby a vessel may intentionally transmit a false status to compel other ships to alter course or yield navigational space. The weight of this criterion was set at 5%. The deliberate deactivation of the AIS signal (C6) is typically intended to hinder vessel tracking or the acquisition of information about the ship. Vessels subject to the SOLAS Convention (International Convention for the Safety of Life at Sea) are required to operate this system continuously. The fading of an AIS signal is particularly concerning in areas of heightened security risk. It is possible that AIS signal loss may also result from other external terrorist activities (e.g., jamming, spoofing) that are independent of the crew. However, such actions typically affect all vessels in the vicinity, making this a specific and distinct scenario.