Artificial Intelligence in Maritime Cybersecurity: A Systematic Review of AI-Driven Threat Detection and Risk Mitigation Strategies

Abstract

The maritime industry is undergoing a digital transformation, integrating automation, artificial intelligence (AI), and the Internet of Things (IoT) to enhance operational efficiency and safety. However, this technological evolution has also increased cybersecurity vulnerabilities, exposing vessels, ports, and maritime communication networks to sophisticated cyber threats. This systematic review, conducted following the PRISMA guidelines, examines the current landscape of AI-driven cybersecurity solutions in maritime environments. By analyzing peer-reviewed studies and industry reports, this review identifies key AI methodologies, including machine-learning-based intrusion detection systems, anomaly detection mechanisms, predictive threat modeling, and AI-enhanced zero-trust architectures. This study assesses the effectiveness of these techniques in mitigating cyber risks, explores their implementation challenges, and highlights existing research gaps. The findings indicate that AI-powered solutions significantly enhance real-time threat detection and response capabilities in maritime networks, yet issues such as data scarcity, regulatory constraints, and adversarial attacks on AI models remain unresolved. Future research directions should focus on integrating AI with blockchain, federated learning, and quantum cryptographic techniques to strengthen maritime cybersecurity frameworks.

1. Introduction

The maritime industry, a cornerstone of global trade and logistics, is undergoing a profound digital transformation driven by artificial intelligence (AI), automation, and interconnected systems that redefine maritime operations. Technologies such as the Internet of Things (IoT), autonomous ships, smart ports, and cloud-based fleet monitoring have significantly optimized operations such as shipping routes, cargo tracking, and fuel consumption. Yet, this digital evolution has simultaneously expanded the threat landscape, exposing critical maritime infrastructure to cyberattacks capable of disrupting global supply chains, compromising navigational safety, and causing severe financial and environmental consequences.

Maritime networks rely on a complex ecosystem of satellite communications, ship-to-shore data exchanges, and remote monitoring systems. The increased connectivity has widened the attack surface, making the sector vulnerable to ransomware, GPS spoofing, denial-of-service (DoS) attacks, and unauthorized intrusions targeting ship control systems. In particular, the integration of AI in maritime cybersecurity has emerged as both a critical safeguard — enabling automation and real-time threat detection — and a potential vulnerability due to its susceptibility to adversarial manipulation and data privacy risks. AI-driven cybersecurity solutions, including machine-learning-based intrusion detection systems (IDSs), anomaly detection frameworks, and predictive threat analytics, offer the potential to automate threat detection, improve response times, and reduce human intervention. However, these benefits are counterbalanced by challenges such as adversarial attacks on AI models, regulatory constraints, and limitations in maritime-specific datasets.

Despite the growing body of research on AI applications in cybersecurity, there is a lack of systematic analysis focused on how AI technologies are specifically applied in maritime environments. The existing literature has largely emphasized traditional cybersecurity measures, with limited exploration of AI-driven approaches tailored to the unique constraints of the maritime domain, such as unreliable network connectivity, operational latency, and the need for real-time decision making in dynamic conditions. This study addresses this gap by conducting a systematic review of AI-based cybersecurity strategies in maritime environments, following the PRISMA methodology. The primary objectives are to (1) identify the key AI techniques employed in maritime cybersecurity, (2) assess their effectiveness in detecting and mitigating cyber threats, (3) examine the challenges associated with AI adoption in maritime security, and (4) propose future research directions for strengthening cybersecurity resilience in the maritime domain.

2. Methods

This systematic review follows the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) guidelines to ensure a rigorous and transparent synthesis of the existing research on AI-driven cybersecurity solutions in the maritime sector. A systematic literature review (SLR) approach was adopted to identify, evaluate, and synthesize the relevant studies on AI applications in maritime cybersecurity, with the focus placed on peer-reviewed journal articles, conference papers, and industry reports discussing AI-driven security measures, including intrusion detection, anomaly detection, zero-trust architectures, and predictive threat modeling in maritime environments.

Study selection was guided by specific inclusion and exclusion criteria: studies explicitly discussing the use of AI for cybersecurity in maritime networks — such as machine learning, deep learning, reinforcement learning, or AI-enhanced blockchain security — published in peer-reviewed journals or high-quality conference proceedings between 2015 and 2025, and providing empirical evaluations, case studies, or simulations of AI-driven cybersecurity mechanisms in maritime environments were included. Studies not specifically addressing maritime cybersecurity or focused solely on traditional, non-AI methods, and papers lacking a clear methodological framework, technical implementation details, or significant contributions were excluded. The systematic search covered IEEE Xplore, Scopus, Web of Science, and Google Scholar using keywords and Boolean operators, supplemented by manual screening of reference lists of key papers, and followed a multi-step selection process: initial title/abstract screening, full-text review, standardized data extraction, with discrepancies resolved by reviewer consensus.

A qualitative synthesis of the extracted data was performed to identify common AI techniques used in maritime cybersecurity, assess their effectiveness, and highlight existing research gaps. Studies were categorized by the specific AI methodologies employed, such as supervised learning for threat detection, unsupervised learning for anomaly detection, and reinforcement learning for adaptive cybersecurity measures, alongside an assessment of bias and study limitations to ensure reliability. A PRISMA flow diagram was generated to illustrate the study selection process, detailing the number of records identified, screened, included, and excluded at each stage, and the final dataset was systematically analyzed to derive insights into the current state of AI-driven maritime cybersecurity and its future research directions.

3. Results

The systematic search across academic databases identified an initial set of 1069 articles. After applying document-type restrictions and subject-area filters, the dataset was refined to 695 articles, and further filtering by cybersecurity- and AI-related keywords, followed by title/abstract screening and full-text assessment, led to the final selection of highly relevant studies on AI-driven cybersecurity applications in the maritime sector. Citation analysis revealed a growing research impact with 7006 total citations, and publication volume peaked in 2023 with 167 articles. China and the United States lead the geographical distribution with 157 and 107 publications respectively, followed by the UK, India, Italy, Norway, and Germany, while a substantial portion of publications (401 documents) consists of conference papers versus 261 peer-reviewed journal articles, indicating a rapidly evolving field still undergoing experimental validation.

The final dataset comprises research on a wide range of AI techniques for cybersecurity in maritime environments: machine learning, deep learning, reinforcement learning, blockchain security, and zero-trust architectures, with applications in autonomous ships, smart ports, maritime logistics, and ship-to-shore communications. The literature is dominated by anomaly detection in maritime networks, where AI models have been trained to identify cyber threats in AIS systems, vessel communication channels, and satellite-based maritime navigation systems. Deep learning techniques — particularly CNNs and RNNs — frequently appear in maritime threat prediction and attack detection studies, and several works introduce hybrid models combining supervised and unsupervised learning to improve intrusion detection accuracy and efficiency in maritime cybersecurity frameworks.

Cyber risk assessment for autonomous ships has gained increasing attention, with many studies emphasizing the vulnerabilities of unmanned maritime systems and proposing AI-enhanced security models for continuous monitoring, breach prediction, and autonomous mitigation. Blockchain integration for secure maritime transactions and ship authentication is emerging as a key research area, federated learning is emerging as a privacy-preserving solution enabling distributed model training without centralized data storage, and AI-powered zero-trust architectures continuously verify access credentials in maritime cloud systems. Another major research area is AI applied to maritime threat intelligence and cyberattack prediction, using NLP models to analyze incident reports and graph-based techniques to model threat propagation.

A comprehensive bias assessment of the selected studies revealed several critical limitations from multiple sources: selection bias from reliance on small-scale or synthetic non-representative datasets (about 30% of studies) and training on generic IT datasets differing radically from maritime environments; validation bias from evaluating models only in simulation environments (about 25%); algorithmic bias from black-box deep models without explainability mechanisms (about 15%); deployment bias from models remaining at proof-of-concept stage without operational testing (about 12%); adversarial vulnerabilities from ignoring input-manipulation attacks (about 10%); and regulatory blind spots from ignoring legal and ethical constraints (about 8%). To address these, the review recommends developing realistic maritime datasets, operational pilot deployments, explainable AI, adversarially robust training, and alignment with international compliance requirements.

4. Discussion

This systematic review underscores the growing importance of AI in enhancing maritime cybersecurity, with the analysis of 278 studies revealing AI integration across multiple layers: intrusion detection systems, anomaly detection frameworks, cyber risk assessment models, AI-driven encryption methods, and blockchain-supported authentication protocols, with considerable precision in identifying threats, recognizing malicious patterns, predicting vulnerabilities, and automating threat responses. Among the most frequent applications is machine-learning-based anomaly detection in ship trajectory monitoring, vessel communication networks, and AIS security — a system vital for navigational safety yet vulnerable to spoofing and manipulation — where deep-learning models have shown promise in detecting navigation anomalies and unauthorized access. AI models have also been applied to securing satellite communications, shipboard networks, and software-defined communication systems; blockchain integration supports identity management and data integrity, while federated learning preserves data privacy across jurisdictional maritime networks.

Despite advancements, fundamental limitations persist: scarcity of high-quality labeled maritime datasets, with most models trained on generic data not reflecting maritime network conditions (limited bandwidth, high latency, isolated environments) and real maritime incidents rarely reported publicly; vulnerability to adversarial attacks where small crafted perturbations in sensor readings or network traffic can cause critical misclassifications; lack of explainability, with deep neural networks and reinforcement learning operating as black boxes without transparency, undermining trust and complicating auditing and regulatory approval; and regulatory and legal constraints, as organizations such as the IMO and EMSA impose strict requirements while AI systems lack compliance mechanisms and clear accountability structures — particularly around liability for failures — with cross-border data governance further complicating global adoption.

To fully realize AI's potential in maritime cybersecurity, future research must explore innovative pathways: quantum-resilient AI security by integrating post-quantum cryptography and quantum key distribution to protect autonomous-ship and smart-port communications; federated learning for privacy-preserving collaboration across fleets and port systems without transferring sensitive data, optimized for low-bandwidth, high-latency environments; enhancing explainable AI with techniques such as SHAP, LIME, and graph-based interpretability to build trust and support security teams; and developing AI-specific maritime cybersecurity standards covering accountability for decisions, standardized performance metrics, cross-border risk governance frameworks, and ethical safeguards against surveillance misuse.

Integrating AI into maritime cybersecurity systems raises substantial regulatory, legal, and ethical challenges requiring governance evolution: liability ambiguity when models fail or issue disruptive false alerts demands clear accountability structures, audit mechanisms, and human–AI collaboration guidelines treating AI as a decision-support system rather than a fully autonomous actor; maritime cybersecurity is inherently global while current regulations are fragmented and rarely AI-specific, demanding internationally recognized compliance frameworks, shared threat-intelligence platforms, and professional certification programs; and AI use may extend into surveillance and behavioral profiling, requiring boundaries between cybersecurity and surveillance, privacy-by-design principles, and transparency disclosures. The review answers its four research questions: the AI techniques in use (machine learning, deep learning, reinforcement learning, federated learning, enhanced blockchain); their effectiveness (improved accuracy, faster response, automated mitigation, but limited by simulation testing and data scarcity); adoption challenges (bias and scarcity, adversarial attacks, missing explainability, regulatory ambiguity, ethical concerns); and future directions (large-scale maritime datasets, adversarial robustness, explanatory frameworks, standardized governance, quantum technology integration).

5. Conclusions

This systematic review highlights the transformative role of AI in maritime cybersecurity, particularly in intrusion detection, anomaly detection, AI-enhanced blockchain security, and cyber risk assessment for autonomous vessels and port infrastructures. AI-driven cybersecurity solutions offer unprecedented capabilities in threat prediction, attack mitigation, and automated security monitoring, providing a proactive defense mechanism against increasingly sophisticated cyber threats targeting the maritime sector. However, critical challenges persist: the lack of high-quality maritime cybersecurity datasets limits model accuracy and generalizability, vulnerability to adversarial attacks raises reliability concerns, the black-box nature of deep learning hinders explainability and creates trust issues among professionals, operators, and regulators, and the absence of standardized AI policies and international regulatory alignment complicates large-scale deployment.

Future research must focus on enhancing the resilience, interpretability, and adaptability of AI-driven cybersecurity frameworks, integrating quantum-resistant AI security models to future-proof systems, exploring federated learning architectures for collaborative training with privacy preservation, and developing explainable AI models to increase trust and regulatory acceptance. From a policy perspective, urgent steps must establish globally standardized AI cybersecurity regulations aligned with international legal, ethical, and operational frameworks, with governments, maritime cybersecurity agencies, and AI researchers collaborating to define liability structures, ethical principles, and governance policies for safe and responsible deployment. By addressing these technological, regulatory, and operational challenges, AI solutions can be fully optimized, standardized, and deployed at scale, securing the future of global shipping, naval defense operations, and smart port infrastructures.