Towards Capability Development: A Layered Analysis of AIS Replay and Ghost Ship Attacks

Abstract

The Automatic Identification System (AIS) is a fundamental component of modern Maritime Situational Awareness (MSA) systems, supporting navigation safety, vessel traffic management, and maritime surveillance. However, the absence of authentication, integrity protection, and message verification makes AIS vulnerable to a range of spoofing attacks capable of manipulating the maritime operational picture. Although existing research has proposed various techniques for detecting AIS spoofing, comparatively little attention has been given to understanding how different spoofing mechanisms influence operational behaviour and the capabilities required to detect and respond to them. To address this gap, the paper introduces a focused taxonomy that distinguishes replay and ghost ship attacks, while accounting for hybrid scenarios that combine characteristics of both mechanisms. A layered threat analysis characterises their observable manifestations across the physical, network infrastructure, AIS protocol, AIS message validation, and operational behaviour layers and identifies the distinct operational capabilities required to detect, distinguish, and respond to these attacks. Building upon this analysis, the paper proposes a structured capability-driven cyber range exercise design approach that systematically translates these capabilities into learning objectives and differentiated training scenarios. Furthermore, the work contributes guidelines for evaluating participants' performance in alignment with the proposed operational capabilities and learning objectives. Overall, the work provides a structured analytical framework for understanding AIS replay and ghost ship attacks, and their combination, and a practical approach for developing capability-driven maritime cybersecurity training aligned with their operational characteristics.

1. Introduction

AIS has evolved into one of the most important technologies supporting Maritime Situational Awareness (MSA). Originally introduced as a collision avoidance and navigational safety mechanism [2], AIS enables vessels to automatically exchange dynamic and static information, including vessel identity, position, speed, heading, navigational status, and voyage-related information [3]. Through this capability, AIS supports a wide range of maritime operations, including collision avoidance, vessel traffic management, maritime surveillance, search and rescue (SAR), border protection, fisheries monitoring, and port operations [4].

Despite its operational importance, the AIS protocol presents significant cybersecurity vulnerabilities due to its lack of authentication, integrity protection, and encryption mechanisms [4,5]. These weaknesses expose AIS to numerous cyber threats, including message manipulation, identity spoofing [4,6], replay attacks [7,8], and the generation of fabricated vessels [9,10]. Such attacks compromise the integrity of maritime operations by manipulating the maritime operational picture, reducing trust in AIS information, and potentially affecting navigational safety, maritime surveillance, and operational decision support [11].

While AIS was intended to enhance navigational safety, cybersecurity was not prioritized during its development: AIS messages are transmitted in plaintext and are accepted by receiving systems under a trust-based architecture that assumes transmitted information is legitimate. Consequently, receiving systems cannot verify either the origin or the integrity of AIS messages, allowing adversaries to manipulate, replay, or fabricate maritime information without being readily detected. These architectural limitations have been extensively documented and remain one of the principal cybersecurity challenges affecting modern maritime systems [9].

To address this gap, the paper makes two principal contributions: first, a focused taxonomy, informed by the existing literature and a layered threat analysis that differentiates replay and ghost ship attacks based on their technical characteristics, operational manifestations, and defensive implications across five layers of the AIS ecosystem; and second, a structured approach that systematically translates the derived operational capabilities into learning objectives, differentiated scenario designs, and operational evidence, alongside guidelines for performance assessment — illustrated by a cyber range exercise design showing how threat analysis can be transformed into structured capability development. The remainder of the paper is organised as follows: Section 2 methodology, Section 3 related work, Section 4 taxonomy and layered analysis, Section 5 operational capability requirements, Section 6 capability-driven exercise design, Section 7 cyber range implementation example, Section 8 limitations and future work, and Section 9 conclusions.

2. Methodology

This study adopted a qualitative analytical research approach to examine the differences between AIS replay and ghost ship attacks and translate the findings into operational capability requirements to drive the design of maritime cyber range training scenarios. The research was conducted in four sequential phases (see Figure 1 of the original paper): first, a structured review of the literature on AIS spoofing attacks, detection approaches, maritime cyber operations, and related training activities, using combinations of terms including "AIS spoofing," "AIS replay attack," "ghost ship," "fabricated AIS vessel," "AIS taxonomy," and "maritime cyber range," extracting and thematically synthesising attack characteristics, execution paths, detection methods, and operational implications; second, development of a focused AIS spoofing taxonomy classifying replay, ghost ship, and hybrid attacks according to the mechanism through which deceptive maritime information is introduced into the AIS ecosystem; third, examination of the identified attack categories through a layered threat analysis across five analytical layers (Physical, Network Infrastructure, AIS Protocol, AIS Message Validation, and Operational Behaviour) to identify the observable characteristics distinguishing replay and ghost ship attacks, subsequently synthesised to derive the operational capability requirements for effective detection and response.

Fourth, the derived operational capability requirements informed the design of maritime cyber range exercises through a structured design approach demonstrating how operational capabilities can be systematically transformed into learning objectives, scenario design, operational evidence, implementation, and assessment. The cyber range exercise presented in the paper serves as an illustrative example of how the analytical findings can be operationalised within a realistic maritime training environment, implemented using a specialised Maritime cyber range developed by the Cyprus Centre of Cybersecurity, Telecommunications & Critical Infrastructure Protection (CTRL) at the Open University of Cyprus.

3. Related Work

Research on AIS security has expanded considerably as maritime operations have become increasingly dependent on AIS-derived MSA for navigation, vessel traffic management, surveillance, and decision support. Early security studies demonstrated that AIS lacks authentication, integrity protection, and message freshness mechanisms, making it vulnerable to message manipulation, vessel impersonation, fabricated vessel generation, and replay attacks [4,22–25]. Although recent developments in maritime communication standards, including the IEC 61162-450/460 series, introduce mechanisms that improve the security of certain maritime network infrastructures [26], these mechanisms do not authenticate open AIS radio broadcasts and are not universally deployed [27]; consequently, replay attacks, fabricated vessel generation, and other AIS spoofing techniques remain feasible in operational environments [28].

A substantial body of research investigates AIS anomaly detection using vessel trajectories, behavioural modelling, statistical analysis, machine learning, and deep learning techniques [12,32–36], by analysing route deviations, unexpected speed changes, anomalous headings, AIS silence, loitering behaviour, and physically implausible trajectories. While highly effective for recognising suspicious vessel behaviour, these methods generally identify anomalies without determining the underlying cyber attack responsible for them. Complementary research focuses on validating AIS messages and detecting manipulated information through kinematic validation, protocol compliance verification, TDMA timing analysis, trajectory consistency, behavioural plausibility assessment, and integrity verification of static and dynamic vessel information [19,37,38], and other studies have demonstrated that multisensor fusion — AIS with radar, RF observations, satellite imagery, or other surveillance sources — significantly improves the detection of manipulated maritime targets [39,40].

Among AIS spoofing techniques, replay attacks and ghost ship attacks represent two fundamentally different attack mechanisms: replay attacks reuse previously legitimate AIS transmissions or trajectories, introducing temporally incorrect but authentic vessel information into the maritime picture, and existing detection approaches rely primarily on timestamp verification, freshness validation [8,41], behavioural consistency, SIEM-based monitoring, protocol analysis, and cryptographic mechanisms designed to detect the reuse of historical information [17]. Ghost ship attacks, in contrast, generate fabricated AIS messages describing vessels that do not physically exist or deliberately impersonate legitimate vessels through fabricated information, and ghost ship detection focuses on validating vessel identities, analysing trajectory plausibility, detecting inconsistencies in static vessel information, and correlating AIS data with independent surveillance sources such as radar or electro-optical (EO) systems [19,37,43,44]; because fabricated vessels frequently lack corresponding physical observations, multisensor correlation has become one of the most effective approaches for identifying this class of attack.

Existing AIS security classifications are generally organised according to attack vectors, affected components, security properties, or observable anomalies, but provide limited guidance on how the distinguishing characteristics of replay and ghost ship attacks can be translated into operational capability requirements that can ultimately drive the design of appropriate maritime cyber range exercises. Overall, the reviewed literature has significantly advanced the detection and mitigation of AIS spoofing attacks, yet existing studies and classifications predominantly investigate replay and ghost ship attacks as isolated technical problems and devote comparatively little attention to understanding how their differing characteristics influence operational behaviour or the capabilities required to detect and respond to them — the gap this paper addresses by systematically characterising replay and ghost ship attack behaviour across the AIS ecosystem, deriving the operational implications associated with each attack category, and demonstrating, through an illustrative cyber range use case, how the findings can inform the design of differentiated, capability-informed maritime cybersecurity training.

4. Taxonomy and Layered Threat Analysis of AIS Spoofing

AIS spoofing is commonly discussed as a single class of cyber attack despite encompassing multiple mechanisms for manipulating maritime situational awareness. Although these attacks share the objective of deceiving operators by presenting false or misleading maritime information, they differ substantially in how AIS data are generated, manipulated, and introduced into the maritime operational picture — differences that influence not only the technical implementation of the attacks but also their observable characteristics and operational manifestations. To provide a structured understanding of AIS spoofing, this paper introduces a focused taxonomy comprising two primary categories — replay attacks and ghost ship attacks — with hybrid attacks treated as a combination of these mechanisms rather than a separate primary category. The taxonomy classifies attacks according to the nature of the deception rather than the specific technical techniques used to execute them, and it is not intended to provide an exhaustive classification of every form of AIS manipulation; related threats that alter the live information of a genuine vessel without replaying historical data or creating a fabricated vessel are excluded from the taxonomy.

Replay attacks involve the capture and retransmission of previously legitimate AIS traffic: instead of creating new vessel information, the attacker reuses authentic AIS messages outside their original temporal or geographical context, so the transmitted information remains syntactically correct and corresponds to a genuine vessel but no longer accurately reflects the current operational situation. Replay attacks may be realised through several mechanisms, including RF replay of captured AIS transmissions, replay of AIS packets within communication networks, replay of AIS feed information, or reintroduction of historical vessel tracks from databases. Regardless of the execution method, the objective is to manipulate maritime situational awareness by presenting legitimate but contextually incorrect information; consequently, replay attacks primarily compromise information freshness and temporal consistency while preserving the authenticity of the underlying AIS messages.

Ghost ship attacks involve the generation of fabricated AIS information describing vessels that do not physically exist, or involve the impersonation of legitimate vessels through fabricated information. Unlike replay attacks, these attacks require the creation of synthetic vessel identities, navigational data, and behavioural characteristics that appear plausible within the maritime environment. Ghost ships may be introduced through RF-based message injection, network manipulation, compromised AIS feeds, or application and database manipulation. Depending on the attacker's objectives and level of access, fabricated targets may coexist with legitimate vessels or replace selected attributes of genuine maritime contacts. As a result, ghost ship attacks primarily challenge vessel authenticity, target verification, and the integrity of the recognised maritime picture.

Sophisticated adversaries may combine replay and ghost ship techniques to create highly realistic deception campaigns: hybrid attacks blend legitimate historical AIS information with fabricated vessel data, producing manipulated maritime situations that appear operationally plausible over extended periods. For example, an attacker may reuse the historical trajectory of a genuine vessel while modifying its identity, timestamps, destination, position, or other voyage-related information. A hybrid attack may therefore exhibit the temporal characteristics of replay alongside the identity and authenticity inconsistencies associated with a ghost ship attack. By simultaneously exploiting the characteristics of replay and ghost ship attacks, hybrid attacks increase the complexity of detection and investigation and represent one of the most challenging categories of AIS spoofing.

While the proposed taxonomy classifies AIS spoofing according to the nature of the deception, each attack category may be realised through multiple technical execution paths depending on the attacker's objectives, technical capabilities, and level of access to the maritime environment. Analysis of the existing literature identifies five principal execution paths that repeatedly appear across AIS spoofing campaigns: GNSS manipulation, which spoofs satellite navigation signals to the target vessel so that the AIS transponder continues to operate normally but broadcasts erroneous position, speed, and course information derived from falsified navigation data while transmitted AIS messages remain protocol compliant; RF layer manipulation, using Software Defined Radio (SDR) technologies to inject fabricated AIS messages or replay previously captured transmissions directly into the VHF communication channel; network layer manipulation through packet injection, interception, replay, redirection, or session hijacking, with Adversary-in-the-Middle (AiTM) attacks representing a particularly important execution path enabling modification or replay of AIS information exchanged between sensors, aggregation services, and command-and-control systems without altering the original RF transmission; AIS feed manipulation, where compromised aggregation services represent attractive targets since a single compromise may simultaneously affect multiple downstream consumers by introducing fabricated vessels, suppressing legitimate targets, or replaying historical traffic; and application and database manipulation, where compromised AIS servers, databases, APIs, or visualisation platforms allow attackers to introduce fabricated vessels or replay historical traffic after data collection has occurred. Although these paths differ in technical implementation, they all seek to manipulate the recognised maritime picture by exploiting different stages of the AIS information lifecycle.

To address the lack of a structured analytical framework comparing how the two attack categories propagate across the AIS ecosystem and influence maritime situational awareness, a layered threat analysis examines replay and ghost ship attacks across five complementary analytical layers: the Physical Layer, Network Infrastructure Layer, AIS Protocol Layer, AIS Message Validation Layer, and Operational Behaviour Layer (see Figure 2 of the original paper). The analysis identifies the observable characteristics associated with each attack type across successive stages of AIS communication and processing, synthesised in Table 1, which highlights the principal distinctions between the two attack categories. At the Physical and Network Infrastructure layers, the principal distinction concerns the origin of the manipulated information: replay attacks reuse legitimate AIS transmissions or previously recorded information, exploiting the credibility of authentic historical information, whereas ghost ship attacks require the generation and introduction of entirely synthetic maritime data, depending on convincing but fabricated vessel identities and associated navigational data. Further distinctions emerge at the AIS Protocol and AIS Message Validation layers: replay attacks typically preserve protocol compliance because authentic AIS messages are reused without modification, making them difficult to distinguish using protocol analysis alone, whereas generating protocol-compliant messages and synthetic vessel attributes creates additional opportunities for detection through protocol inconsistencies, identity validation, behavioural plausibility assessment, and multisensor verification. Consequently, replay attacks primarily compromise information freshness and temporal validity, whereas ghost ship attacks primarily compromise vessel authenticity and identity. These differences become most evident at the Operational Behaviour layer: replay attacks reproduce genuine historical vessel movements outside their original temporal context, creating uncertainty regarding the current validity of maritime information, whereas ghost ship attacks introduce entirely fabricated maritime contacts that challenge the credibility of the recognised maritime picture and require operators to determine whether the reported vessel actually exists. Hybrid attacks may produce combined manifestations across these layers: replayed messages may retain valid protocol structures and historically plausible movement, while fabricated identity, timing, or navigational attributes introduce inconsistencies at the message-validation and operational-behaviour layers — so their detection requires operators to consider temporal validity and vessel authenticity simultaneously rather than treating the presence of one type of evidence as excluding the other.

5. Operational Capability Requirements

The layered threat analysis demonstrates that replay and ghost ship attacks differ not only in their technical implementation but also in the operational challenges they introduce for maritime operators: while both attack types manipulate AIS information, they do so through fundamentally different deception mechanisms — replay attacks exploit the temporal validity of authentic AIS transmissions by reusing legitimate information outside its original operational context, whereas ghost ship attacks generate synthetic vessel information intended to create entirely fictitious maritime contacts. This differentiation shows that the analytical requirements for identifying, interpreting, and responding to these attacks extend beyond technical detection and require distinct forms of operational reasoning. To systematically derive these requirements, the layered threat analysis was abstracted into a structured set of operational analytical capability requirements, following three successive levels of abstraction (see Table 2 of the original paper): the first level — technical evidence — focuses on the physical, network, and protocol characteristics that provide indicators of AIS manipulation and answers "what technical evidence indicates AIS manipulation?"; the second level — information validation — assesses the integrity, authenticity, and operational validity of reported maritime information and answers "can the reported maritime information be trusted?"; and the third level — operational reasoning — examines how operators interpret validated information to maintain situational awareness, support decision-making, and prioritise appropriate operational responses, answering "how should operators interpret the evidence and determine an appropriate response?" These abstraction levels establish an analytical progression from low-level technical observations to high-level operational reasoning, providing the conceptual foundation for deriving operational capability requirements.

Building upon the three abstraction levels, Table 3 of the original paper synthesises the findings of the layered threat analysis into a structured set of operational capability requirements, by mapping each operational capability to an observable characteristic, the distinct manifestations of replay and ghost ship attacks, and the corresponding operational challenge that maritime operators must resolve — explicitly showing how technical attack characteristics are systematically translated into distinct analytical requirements. On the Physical layer the capabilities include: correlating RF transmissions with expected vessel positions and transmission sources, validating reported vessel presence using independent maritime information sources, and evaluating geographical consistency using contextual maritime information. On the Network Infrastructure layer: tracing information provenance across the communication chain, and correlating information obtained from multiple independent sources to determine which operational picture is trustworthy. On the AIS Protocol layer: analysing protocol behaviour to identify indicators of message manipulation, assessing temporal consistency of AIS transmissions, and validating message integrity and identifying anomalies. On the AIS Message Validation layer: verifying vessel identity using authoritative maritime information, validating navigational information against independent evidence, and assessing information validity and operational relevance. On the Operational Behaviour layer — operational assessment: reconstructing the temporal evolution of vessel activity, evaluating the plausibility of observed behavioural patterns against expected maritime operations, and differentiating temporal inconsistencies from authenticity-related inconsistencies when assessing the operational picture; and on the Operational Behaviour layer — operational decision-making: integrating multiple independent sources of evidence to support operational judgement under uncertainty, and prioritising operational response according to the characteristics and impact of the spoofing attack.

Although Table 3 focuses on comparing replay and ghost ship attacks, the identified capabilities also provide the basis for analysing hybrid attacks: operators must then combine temporal and behavioural analysis with identity validation, multisensor correlation, and information-provenance assessment, and must avoid treating evidence of replay as excluding the simultaneous fabrication or modification of AIS information. The principal capability required for hybrid incidents is therefore the ability to integrate multiple forms of evidence, maintain competing explanations, and revise the initial attack classification as additional information becomes available.

6. Capability-Driven Design of Maritime Cyber Range Exercises

The operational capability requirements presented in the previous section establish the competencies required to identify, interpret, and respond to replay and ghost ship attacks. The next step is to translate these analytical requirements into an instructional design that enables maritime personnel to develop and demonstrate these capabilities within a realistic operational environment. The proposed approach adopts a capability-driven design philosophy in which exercise objectives are directly informed by the operational reasoning requirements identified through the layered threat analysis. This design philosophy recognises that effective cyber range training extends beyond exposing participants to technical attack scenarios; instead, learning activities should reproduce the cognitive processes required during real maritime operations — including information validation, evidence correlation, behavioural assessment, and decision-making under uncertainty. Consequently, replay and ghost ship attacks are not treated simply as technical events to be detected, but as operational problems requiring participants to interpret multiple sources of evidence, distinguish between different deception mechanisms, and justify their operational decisions. For hybrid attacks, participants must also determine whether temporal and authentication inconsistencies indicate the simultaneous use of replayed and fabricated information. Figure 3 of the original paper illustrates the proposed capability-driven exercise design approach, establishing a structured progression from threat analysis and operational capability requirements to learning objectives specification, exercise implementation, and assessment — ensuring that the cyber range exercise directly supports the development and evaluation of the identified operational analytical capabilities.

The operational capability requirements define the knowledge, reasoning processes, and decision-making abilities required to identify, interpret, and respond to AIS replay and ghost ship attacks. From an instructional design perspective, these capabilities represent complementary components of broader operational competencies rather than isolated technical skills; consequently, the proposed exercise design synthesises related operational analytical capabilities into a set of integrated learning objectives reflecting the reasoning processes required during real-world maritime cyber incidents. This capability-driven approach shifts the focus of cyber range training beyond technical attack detection towards the development of higher-order analytical competencies: participants are expected to validate maritime information, interpret technical and operational evidence, assess the plausibility of vessel behaviour, and make informed operational decisions under conditions of uncertainty. Table 4 of the original paper provides an illustrative example of how learning objectives can be systematically derived from the operational capability domains: instead of a one-to-one correspondence between individual capabilities and learning objectives, the approach groups complementary capabilities into broader instructional domains reflecting integrated operational reasoning processes — four objectives: validating the authenticity and integrity of AIS information using multiple independent maritime information sources (LO1); differentiating replay and ghost ship attacks through temporal, behavioural, and contextual analysis (LO2); producing evidence-based situational assessments by integrating information from multiple maritime data sources (LO3); and selecting and justifying appropriate operational response actions based on validated evidence and the evolving operational context (LO4). The table is illustrative rather than exhaustive, showing how operational analytical capabilities can be translated into measurable educational outcomes for cyber range exercise design.

The learning objectives provide the foundation for the design of cyber range exercises: the proposed approach adopts a capability-driven design in which every stage of an exercise is intended to provide participants with opportunities to demonstrate specific operational analytical capabilities. Exercise scenarios are designed to progressively increase both the complexity of the operational situation and the analytical demands placed upon participants: instead of immediately revealing the nature of the cyber attack, participants are initially exposed to operational anomalies that require investigation, and as additional information becomes available through successive scenario injects, participants are expected to continuously reassess their hypotheses, correlate evidence from different maritime information sources, and determine whether the observed anomalies are consistent with legitimate operational conditions, replay attacks, or ghost ship attacks. Hybrid scenarios are expected to deliberately combine temporal and authenticity-related inconsistencies — for example, a trainer may reuse a legitimate historical vessel trajectory while modifying selected identity, timestamp, destination, or navigational fields, so that initial evidence indicates a replay attack while later registry, radar, communication, or network evidence reveals that fabricated information has also been introduced. Such scenarios require participants to avoid premature classification and determine whether the incident represents replay, fabrication, a hybrid attack, or a non-malicious data anomaly. This progressive disclosure of information encourages continuous situational assessment instead of isolated technical analysis, with each inject designed to provide additional operational evidence supporting one or more learning objectives — requiring participants to validate maritime information, assess temporal consistency, evaluate vessel behaviour, correlate evidence across heterogeneous information sources, or justify operational decisions. The inject sequence mirrors the progressive reasoning process of real maritime incident response, allowing participants to iteratively construct, refine, and validate their understanding of the evolving operational situation.

The capability-driven scenario design is realised through the systematic provision of operational evidence and supporting exercise artefacts enabling participants to achieve the intended learning objectives: an exercise should provide multiple sources of operational information enriched with representative technical information that must be analysed, validated, and interpreted throughout the scenario — reflecting the realities of maritime operations, where cybersecurity incidents are rarely identified through a single observable event but emerge through the correlation of multiple, often incomplete, sources of operational and technical evidence. Table 5 of the original paper presents illustrative examples of operational evidence, representative technical information, and their relationship to the learning objectives: live AIS transmissions (MMSI consistency, SOG, COG, heading, message integrity — LO1); historical AIS records (timestamp continuity, repeated message patterns — LO2); radar tracks (position discrepancies, target correlation — LO3); vessel registry information (MMSI registration, IMO number, call sign — LO1); GNSS information (position mismatch, navigation discrepancies — LO3); bridge observations and operator reports (visual confirmation, traffic behaviour — LO2, LO3); communication records (VHF reports, operational notifications — LO3); and system and network logs (authentication events, protocol anomalies — LO3, LO4). Operational evidence should be introduced progressively through scenario injects mirroring the evolution of a real maritime cyber incident — rather than providing all available information simultaneously, new artefacts and associated technical information are released as the operational situation develops, requiring participants to continuously update their situational understanding, reassess previously formed hypotheses, and justify their decisions using the evidence available at each stage of the exercise.

Section 6.5 provides guidelines for assessing participant performance in alignment with the operational capabilities and learning objectives: rather than measuring success solely by scenario task completion or identification of an AIS spoofing attack, the proposed approach considers how participants apply relevant capabilities such as analytical reasoning, evidence interpretation, decision-making, and communication throughout the exercise. Assessment should be performed continuously during exercise execution by combining instructor observations with objective evidence automatically generated by the cyber range environment: relevant participant activities include interpreting operational artefacts, formulating and revising analytical hypotheses, correlating information from multiple maritime sources, distinguishing among competing explanations, justifying operational decisions, and communicating findings throughout the incident response process. Table 6 of the original paper presents illustrative assessment areas corresponding to the operational capability domains: information validation (validating the authenticity and integrity of AIS information across radar, GNSS, and registry data); temporal and behavioural analysis (differentiating replay and ghost ship attacks using temporal and behavioural evidence); evidence correlation and situational assessment (integrating heterogeneous operational information before reaching conclusions); operational decision-making (selecting and justifying appropriate operational response actions); and communication (clearly communicating findings, recommendations, and operational rationale). The assessment process can follow four stages: selecting the capability domains relevant to the exercise learning objectives, identifying the participant activities through which these capabilities may become observable, collecting the corresponding cyber-range records and operational artefacts, and finally using the collected evidence during assessment and debriefing to examine how participants interpreted the incident and justified their decisions. Table 6 does not prescribe numerical scores, weighting, pass thresholds, or standardised performance levels, since a scoring model is outside the scope of this work and will be the subject of future work on designing, calibrating, and validating a scoring model.

7. Cyber Range Implementation — Illustrative Example

The proposed capability-driven exercise design was implemented using a specialised Maritime Cyber Range [52] — a virtualised environment designed to support realistic maritime cybersecurity training. While the design approach of the previous sections is platform-independent and may be implemented using different cyber range technologies, the Maritime Cyber Range presented here serves as an illustrative implementation demonstrating how the derived operational capabilities, learning objectives, scenario design, operational evidence, and assessment strategy can be realised within a controlled training environment. Figure 4 illustrates the cyber range implementation architecture: the environment integrates real and simulated AIS infrastructure with maritime surveillance and navigation components — including GNSS and radar data sources, AIS processing servers, command-and-control (C2) systems, and virtualised network infrastructure — plus an adversary workstation used to emulate representative AIS spoofing techniques and an instructor-managed environment enabling the controlled execution of training scenarios. By combining real and synthetic maritime data, the cyber range provides a representative and configurable operational context in which replay and ghost ship attacks can be executed repeatedly, consistently, and safely while maintaining full control over scenario progression and evidence release. The cyber range is designed to provide a representative operational environment rather than a complete physical replica of a ship bridge or maritime surveillance centre; its fidelity is therefore judged against the information and analytical conditions required by the exercise learning objectives — integrating AIS, radar, GNSS, network, and C2 information so participants can analyse temporal and cross-source inconsistencies within a controlled operational setting, with expected variations in sensor observations and system timing incorporated into scenario design rather than treating every cross-source inconsistency as evidence of malicious activity.

Unlike conventional attack-centric cyber range exercises, the implementation is structured around the operational capabilities identified in Section 5 rather than the technical execution of individual attacks; each scenario is therefore designed to progressively expose participants to operational evidence supporting information validation, evidence correlation, situational assessment, and decision-making under uncertainty. To illustrate how the design approach is operationalised, Table 7 presents the progression of a representative ghost ship scenario in five phases: initial maritime picture (monitoring routine traffic using AIS, radar, and GNSS — establishing the operational baseline); suspicious AIS activity (a fabricated vessel introduced with plausible navigational characteristics — recognising potential anomalies); multisource validation (additional evidence via radar, GNSS, and other independent sources — validating information across multiple sources); evidence correlation (progressively released registry information, communications, and operational reports — correlating heterogeneous evidence and assessing credibility); and operational decision (determining whether the anomaly represents a ghost ship attack and justifying the proposed response — situational assessment and evidence-based decision-making). A similar implementation strategy is adopted for replay attack scenarios, although the required operational reasoning differs: rather than detecting fabricated vessels, participants must recognise temporal inconsistencies introduced through the replay of previously legitimate AIS transmissions — so the exercise emphasises validation of temporal information, identification of duplicated or outdated vessel behaviour, and correlation of historical and current operational observations.

Table 8 summarises how the ghost ship, replay, and hybrid scenarios translate into capability-driven cyber range exercises: the scenarios deliberately exercise different analytical and decision-making capabilities by varying the sequence of operational evidence and the reasoning required to identify each attack — the ghost ship scenario introduces a fabricated vessel into the operational picture, radar fails to confirm its presence, and registry and communication records reveal inconsistencies; the replay scenario replays previously legitimate AIS transmissions, temporal inconsistencies emerge between historical and current traffic, and duplicate vessel tracks or outdated navigation behaviour become evident; while the hybrid scenario combines a legitimate historical trajectory with modified identity, timing, or navigational information, so temporal inconsistencies coexist with identity or multisensor inconsistencies, early evidence supports replay while later evidence reveals fabricated or altered information — requiring participants to maintain competing hypotheses and reassess the classification as evidence develops. Figure 5 shows components from the specialised maritime cyber range simulating representative operational conditions during ghost ship and replay attacks. Throughout execution, instructors manage scenario progression through the controlled release of injects, operational evidence, and supporting artefacts while adjusting exercise complexity to the intended learning outcomes, while the cyber range simultaneously records participant interactions, analytical decisions, communications, and system activities — generating objective evidence supporting structured debriefing and the capability-based assessment process.

8. Limitations and Future Work

This work has three main limitations that should be considered when interpreting its contributions: first, the proposed taxonomy and layered threat analysis focus specifically on AIS replay and ghost ship attacks — although hybrid attacks combining characteristics of both categories are considered, the taxonomy is not intended to provide an exhaustive classification of AIS manipulation or spoofing techniques, and other forms of manipulation, including attacks involving the falsification of live vessel data through GNSS manipulation, fall outside the scope of this study. Second, the proposed capability-driven approach was developed by translating the distinguishing technical and operational characteristics identified through the threat analysis into operational capability requirements, learning objectives, scenario design considerations, and assessment evidence — yet while the cyber range exercise design illustrates how this process can be operationalised, the proposed approach has not yet been empirically validated through its delivery to maritime practitioners; consequently, this work does not make claims regarding training effectiveness or measurable capability improvement. Third, the assessment guidelines identify relevant participant activities and sources of evidence that can support trainer judgement but do not prescribe a validated scoring model, performance thresholds, or standardised proficiency levels — so the interpretation of collected evidence remains dependent on trainer judgement and the specific objectives and context of an exercise.

Future work will focus on the empirical validation of the proposed approach through the delivery and evaluation of cyber range exercises involving maritime practitioners — including examining its effectiveness in developing the intended operational capabilities, evaluating participant performance across different experience levels, and refining the scenario design and assessment guidelines based on evidence collected during training activities. Further work will also focus on designing, calibrating, and validating a scoring model for capability-driven assessment and investigating opportunities for automated evidence collection and performance assessment within maritime cyber range environments. Finally, the applicability of the proposed approach to other maritime cyber threats will be investigated to determine the extent to which the threat-analysis-to-capability-development process can support broader maritime cybersecurity training contexts.

9. Conclusions

This paper examined the distinct characteristics of replay and ghost ship attacks and their implications for capability-driven maritime cybersecurity training: a focused taxonomy and layered threat analysis were developed to differentiate these attacks according to their technical characteristics, operational manifestations, and defensive implications across the AIS ecosystem — highlighting how replay and ghost ship attacks create different challenges for detection and operational reasoning, while also accounting for hybrid scenarios in which characteristics of both attack types may coexist. Building upon this analysis, the paper identified the operational capabilities required to recognise, differentiate, and respond to these attacks and proposed a structured approach for translating them into learning objectives, differentiated scenario designs, operational evidence, and capability-driven assessment. The cyber range exercise design illustrates how this process can be applied in practice, providing trainers with a systematic approach for moving from threat analysis to the development and assessment of operational capabilities. Although demonstrated in the context of AIS replay and ghost ship attacks, the proposed approach provides a foundation that may be adapted to other maritime cyber threats where differences in attack characteristics have implications for operational reasoning and training design.

Ultimately, effective preparation for AIS spoofing incidents requires more than exposing participants to a generic spoofing scenario: it requires exercises that reflect the distinguishing characteristics of the threats participants may encounter and require them to interpret evidence, differentiate between competing explanations, and adapt their decisions as the operational picture evolves. By establishing an explicit connection between threat characteristics, operational capabilities, and exercise design, this work provides a foundation for developing maritime cybersecurity training that more closely reflects the analytical demands of real-world AIS spoofing incidents.