A study on fleet security monitoring framework based on maritime cyber incident response

Abstract

This study proposes a fleet-level integrated cybersecurity monitoring framework to address the maritime industry's digital transformation and rising cyber threats. By analyzing incidents from 2010 to 2020, security requirements tailored to ship operations were derived, leading to a framework that links onboard infrastructure with shore-based security operations centers for real-time monitoring and remote response. The framework enhances threat visibility and response across fleets of multiple vessels. Validation using a ransomware scenario confirmed complete detection of threat events and remote response within an average of 2 min and 11 s. Usability and system stability evaluations further demonstrated applicability in operational environments. These findings verify the feasibility of effective fleet-level monitoring and highlight contributions to cyber resilience and incident response strategies. Future scalability may be achieved through AI-driven threat severity assessment and adaptive policy management, ensuring sustainability and adaptability in evolving maritime contexts.