Georgios Potamos

The Automatic Identification System (AIS) is a fundamental component of modern Maritime Situational Awareness (MSA) systems, supporting navigation safety, vessel traffic management, and maritime surveillance. However, the absence of authentication, integrity protection, and message verification makes AIS vulnerable to a range of spoofing attacks capable of manipulating the maritime operational picture. Although existing research has proposed various techniques for detecting AIS spoofing, comparatively little attention has been given to understanding how different spoofing mechanisms influence operational behaviour and the capabilities required to detect and respond to them. To address this gap, the paper introduces a focused taxonomy that distinguishes replay and ghost ship attacks, while accounting for hybrid scenarios that combine characteristics of both mechanisms. A layered threat analysis characterises their observable manifestations across the physical, network infrastructure, AIS protocol, AIS message validation, and operational behaviour layers and identifies the distinct operational capabilities required to detect, distinguish, and respond to these attacks. Building upon this analysis, the paper proposes a structured capability-driven cyber range exercise design approach that systematically translates these capabilities into learning objectives and differentiated training scenarios. Furthermore, the work contributes guidelines for evaluating participants’ performance in alignment with the proposed operational capabilities and learning objectives. Overall, the work provides a structured analytical framework for understanding AIS replay and ghost ship attacks, and their combination, and a practical approach for developing capability-driven maritime cybersecurity training aligned with their operational characteristics.

Cybersecurity is becoming an increasingly important aspect in ensuring maritime data protection and operational continuity. Ships, ports, surveillance and navigation systems, industrial technology, cargo, and logistics systems all contribute to a complex maritime environment with a significant cyberattack surface. To that aim, a wide range of cyberattacks in the maritime domain are possible, with the potential to infect vulnerable information and communication systems, compromising safety and security. The use of navigation and surveillance systems, which are considered as part of the maritime OT sensors, can improve maritime cyber situational awareness. This survey critically investigates whether the fusion of OT data, which are used to provide maritime situational awareness, may also improve the ability to detect cyberincidents in real time or near-real time. It includes a thorough analysis of the relevant literature, emphasizing RF but also other sensors, and data fusion approaches that can help improve maritime cybersecurity.

Information about the paper titled "INCREASE MARITIME CYBER SITUATIONAL AWARENESS AT A STRATEGIC LEVEL" at IATED Digital Library