Advanced Anomaly Detection for Maritime IoT Systems: Integrating Semi-Markov Processes for Robust Cybersecurity

The rapid advancement of digital technologies in maritime operations has led to an urgent demand for specialized cybersecurity strategies, particularly to counter Distributed Denial of Service (DDoS) attacks targeting critical communication protocols like NMEA 2000. This paper presents a distinctive approach utilizing stochastic semi-Markov processes specifically designed to enhance the cybersecurity defenses of maritime IoT systems. By modeling and analyzing the unique state transitions within the maritime network, our proposed model detects unusual activity and issues immediate alerts to operators regarding potential DDoS threats, thereby maintaining stable and secure maritime communications. Extensive simulations illustrate the model’s high precision, effective detection rates, and very low error margins, positioning it as a reliable and specialized solution for safeguarding critical maritime infrastructure. This work makes a substantial contribution to maritime cybersecurity by delivering proactive and adaptive defenses against increasingly sophisticated cyber threats.

I. Introduction

Maritime operations have become increasingly digitalized, making vessels reliant on a wide range of interconnected systems. Protocols such as NMEA 0183, NMEA 2000, VHF Radio Communication (DSC), and IEC 61162-450 lack robust security measures, making maritime IoT systems highly susceptible to specific cyberattacks like Distributed Denial of Service (DDoS) attacks [1] , which can directly affect navigation and operational safety in maritime environments. AIS data integrated through NMEA 0183 and NMEA 2000 is vulnerable to manipulation. Additionally, IEC 61162-450 used for Ethernet communications can be compromised due to weak network segmentation, while VHF DSC communications remain vulnerable due to a lack of encryption. These threats can disrupt navigation and control, posing risks to vessel safety and operations.