## 4 Discussion  
The protection concept for critical maritime infrastructure against potential attacks by vessels, developed by the authors, consists of several stages. The first stage involves the detection of vessels approaching sensitive maritime zones and the collection of detailed data. Currently used radar, radio (including satellite), and hydroacoustic systems are helpful to some extent, but they are not fully reliable and do not operate as part of an integrated platform. The proposed method primarily relies on the automatic identification system and Vessel Traffic Service (VTS) radar imaging, which provide precise information on vessel movements, including speed, course, vessel type, and voyage-related data. However, the AIS operates in the VHF band (Very High Frequency), making it susceptible to signal interference. In the initial research phase, the authors collected AIS data from the southern Baltic Sea using their own receiver, decoded the transmissions, and performed a detailed analysis. This enabled the construction of traffic maps and the behavioral analysis of selected vessels during maneuvering operations (Figures 5, 10 and 11), which served as a foundation for the subsequent stages of the methodology. Data acquisition should also include access to historical information, such as the results of technical inspections and the vessel's registration and certification status in maritime administrations. These datasets are highly valuable for identifying potential threats, though integrating such large and diverse sources requires both legal frameworks for international data access and advanced IT solutions. The European SafeSeaNet system serves as a relevant example of such integration in practice. Emerging technologies, such as cloud-based data analytics and artificial intelligence, provide promising solutions to address these challenges. In the second stage, the detected vessels are assessed using multi-criteria decision analysis based on the PROMETHEE method. The authors defined eight key criteria, thematically grouped, and determined their respective weights and preference functions. The method is based on pairwise comparisons of vessels, resulting in a ranking from the one most to the one least aligned with the risk-related criteria. When analyzing a large set of vessels, graphical results allow for rapid identification of potentially suspicious units. The outcomes are presented in the form of a final ranking (net flow), a criterion-based overview (rainbow), and individual alternative profiles. However, a high position in the ranking does not necessarily indicate malicious intent; the vessel may simply be maneuvering (satisfying criteria C1 and C2). These two criteria carry significant weights (25% and 15%, respectively), as sudden reductions in speed near subsea infrastructure may signal attempts to deploy anchors or interfere with underwater installations. Therefore, such vessels should be subject to continued monitoring and trajectory prediction, as illustrated in Figure 12.  
Another important criterion is compliance with certification standards (C7). While most vessels maintain a valid legal and technical status, there are notable exceptions. For instance, in 2025, the vessel Kiwala was detained after operating without registration under any national flag, thereby engaging in illegal maritime activity. The most important features of the MCDA method in the proposed approach are as follows:  
* The results are dimensionless and relative. * The outcome of the analysis reveals differences in the degree to which the vessels in the set meet the defined criteria. * The analysis requires the provision of multiple data inputs; however, it can still be conducted in the absence of some information, although this may reduce the quality of the results. * A minimum of two vessels must be included in the evaluation. * Vessels with similar final scores will be positioned close to each other in the net flow ranking. * The use of a reference vessel is recommended.