A Novel Cyber-Threat Awareness Framework based on Spatial-Temporal Transformer Encoder for Maritime Transportation Systems

Modern ships have leveraged the development of IoT and AI 2.0 to integrate a vast array of digital infrastructure and navigation-dependent operating systems, facilitating the digitalization of Maritime Transportation Systems (MTS). Inevitably, this high degree of integration amplifies the risks to ship’s navigation safety. Maritime Cyber Threat Awareness (MCTA) can effectively safeguard MTS through AI-enabled cyber threat intelligence (AI-CTI). However, most previous studies adopted a passive defense strategy of manually analyzing threat information, which had low accuracy and made it challenging to deal with heterogeneous cyber threats, such as Advanced Persistent Threat (APT). In this paper, we propose an Awareness framework based on Cyber Threat Spatial-Temporal Transformer (ActSTT) to model maritime cyber threats and accurately identify threat types, which contains two main modules: Temporal Pattern Fusion (TPF) and Threat-driven Awareness (TDA) module. The TDA is able to automatically extract complex attack patterns in MTS networks and help the crew understand the system security situation by perceiving fine-grained cyber threats. With ActSTT, the proposed method achieves accuracy close to 98% and 99% on public datasets as well as our real cyber-ship dataset SCS, respectively, outperforming the current state-of-the-art methods.