The growing reliance on digital technologies onboard vessels has significantly increased their attack surface. As a result, both IT and OT systems are now vulnerable to a range of cyberattacks. However, existing methods used to assess vulnerability and threats often rely on outdated threat or vulnerability information, limiting their effectiveness. Consequently, a more proactive approach to assessing the security of vessel systems is needed. Threat hunting offers a proactive way of gathering the latest threat and vulnerability data from operational maritime vessels, which can be used for comprehensive security assessments. However, there is a lack of systems specifically designed to perform both threat-hunting and security assessment operations. In this paper, we propose a threat-hunting and security assessment framework that collects and processes real-time data from vessels and conducts security analysis using a graphical security model designed for vessel systems. Our approach demonstrates how the collected information can be used to evaluate a ship’s security posture by simulating potential attack scenarios and understanding how an adversary might attempt to compromise the vessel’s network. It also provides a foundation for more informed, data-driven cybersecurity strategies for the unique systems found onboard maritime vessels.

Widely used deep learning models are found to have poor robustness. Little noises can fool state-of-the-art models into making incorrect predictions. While there is a great deal of high-performance attack generation methods, most of them directly add perturbations to original data and measure them using L_p norms; this can break the major structure of data, thus, creating invalid attacks. In this paper, we propose a black-box attack, which, instead of modifying original data, modifies latent features of data extracted by an autoencoder; then, we measure noises in semantic space to protect the semantics of data. We trained autoencoders on MNIST and CIFAR-10 datasets and found optimal adversarial perturbations using a genetic algorithm. Our approach achieved a 100% attack success rate on the first 100 data of MNIST and CIFAR-10 datasets with less perturbation than FGSM.

Modern networks are dynamic with configuration changes that introduces a set of challenge to the network administrator in terms of security and availability. Here, the major challenge faced by the administrator is the increasing number of vulnerabilities with the uncertainties related to defense deployment options and how these options affect the network availability over time. This work proposes a hierarchical model-based approach to evaluate the availability of dynamic networks considering the deployment of different hardening options. In particular, this work adopts reliability block diagrams and Petri nets to represent and analyze dynamic network environments and evaluate their availability. A case study is presented to demonstrate the feasibility, usefulness, and scalability of the proposed approach for computing the availability of dynamic networks considering different hardening options. The proposed approach can be helpful for network administrators who are in charge of choosing the best hardening options taking into account the impacts on availability.

Hardening the dynamic networks is a very challenging task due to their complexity and dynamicity. Moreover, there may be multi-objectives to satisfy, while containing the solutions within the constraints (e.g., fixed budget, availability of countermeasures, performance degradation, non-patchable vulnerabilities, etc). In this paper, we propose a systematic approach to optimise the selection of the security hardening options for the dynamic networks given multiple constraints and objectives. To do so, we evaluate potential attack scenarios for a given time period, and then use a multi-objective optimisation based on Non-dominated Sorting Genetic Algorithm to find the optimal set of security hardening options. We measure the effectiveness of the options using various security metrics, which is demonstrated through experimental analysis. The results show that our approach can be applied to select the optimal set of security hardening options to be deployed for the dynamic networks given multiple objectives and constraints.