# Formulating Cybersecurity Requirements for Autonomous Ships Using the SQUARE Methodology
## 1 Introduction  
In the past few years, we have witnessed substantial growth in the development and deployment of various types of cyberphysical systems. This growth has affected nearly every aspect of our daily life, including power grids, transportation systems, medical devices, and household appliances [1]. It has also brought several changes in the shipbuilding and marine industries. With the increasing ship network connectivity, smart ships have emerged, and the race to secure autonomous ship technologies is intensifying, which may lead to a new paradigm in the maritime industry. Artificial intelligence (AI) technology, the core technology in autonomous navigation systems, is capable of processing high-dimensional information such as human cognition, learning, and reasoning based on data and knowledge [2]. AI technologies such as machine learning and deep learning are expected to support autonomous ships by processing their large amounts of generated data.  
Autonomous ships are the next-generation ships that integrate advanced AI technologies, big data, and sensors; although they satisfy the anticipations of low operating costs and maritime accident prevention [3], they are exposed to many cyberthreats owing to high ship-to-land connectivity, which is, however, essential for their operation and for the management systems on land [4]. Moreover, the use of dual or backup systems should be considered to ensure that the failure of nonbackup systems does not significantly affect the ship's ability to operate, and the ship navigation systems should be designed to ensure high operability [5]. Therefore, the communication systems that support autonomous navigation are considered an essential part of safety systems and, thus, require safety certifications [6]. To solve cybersecurity issues, various studies on ship systems and vulnerabilities in AI technology are being conducted. However, many studies focus on either ship systems or AI technologies separately and fail to consider the convergence of the two areas. The International Association of Classification Societies (IACS) has published the unified requirements (URs) for cyber-resilience in ship systems. The URs apply to all computer-basedsystems, such as the main-engine control, steering, cooling, fire detection, communication (including public address), and navigation systems. Moreover, the URs apply to all newly built ships contracted after 1 January 2024 but do not address the security requirements of autonomous ships.  
It is known that if defects are found in the \"field,\" a lot of money and effort will be required for their elimination [7]; therefore, continuous efforts are being made to minimize security defects by applying security requirements at the design stage via security designs and realizing security internalization. For security internalization, security requirements must be formulated for each design stage. Security requirement engineering can be applied at the design stage to formulate security requirements from the consensus of relevant stakeholders and security experts.  
This paper investigates which AI technologies are utilized in autonomous ships and analyzes those cyberthreats which may arise from the convergence of AI technologies with ship systems. Furthermore, we studied various attack scenarios to examine how previously known and researched cyberthreats can affect autonomous ships and present the necessary research direction for the cybersecurity of autonomous ships. Additionally, security requirements are formulated by applying security requirement engineering to the analyzed and investigated potential cyberthreats.