Formulating Cybersecurity Requirements for Autonomous Ships Using the SQUARE Methodology

Abstract

Artificial intelligence (AI) technology is crucial for developing autonomous ships in the maritime industry. Autonomous ships, based on the collected information, recognize the environment without any human intervention and operate themselves using their own judgment. However, ship-to-land connectivity increased, owing to the real-time monitoring and remote control (for unexpected circumstances) from land; this poses a potential cyberthreat to various data collected inside and outside the ships and to the applied AI technology. For the safety of autonomous ships, cybersecurity around AI technology needs to be considered, in addition to the cybersecurity of the ship systems. By identifying various vulnerabilities and via research cases of the ship systems and AI technologies, this study presents possible cyberattack scenarios on the AI technologies applied to autonomous ships. Based on these attack scenarios, cyberthreats and cybersecurity requirements are formulated for autonomous ships by employing the security quality requirements engineering (SQUARE) methodology.

1. Introduction

In the past few years, we have witnessed substantial growth in the development and deployment of various types of cyberphysical systems. This growth has affected nearly every aspect of our daily life, including power grids, transportation systems, medical devices, and household appliances [1]. It has also brought several changes in the shipbuilding and marine industries. With the increasing ship network connectivity, smart ships have emerged, and the race to secure autonomous ship technologies is intensifying, which may lead to a new paradigm in the maritime industry. Artificial intelligence (AI) technology, the core technology in autonomous navigation systems, is capable of processing high-dimensional information such as human cognition, learning, and reasoning based on data and knowledge [2]. AI technologies such as machine learning and deep learning are expected to support autonomous ships by processing their large amounts of generated data.

Autonomous ships are the next-generation ships that integrate advanced AI technologies, big data, and sensors; although they satisfy the anticipations of low operating costs and maritime accident prevention [3], they are exposed to many cyberthreats owing to high ship-to-land connectivity, which is essential for their operation. Attack vectors include AI models, sensor data, neural networks, and communication protocols. This study presents four attack scenarios — ship dataset attack, sensor data attack, artificial neural network attack, and communication protocol attack — then derives eight security requirements (R-01 to R-08) using the SQUARE methodology, categorized by integrity, reliability, stability, access control, and availability goals, prioritized, and inspected against IACS UR E27 requirements.

2. Background

The core technologies of autonomous ships comprise situational recognition and detection, judgment, action and control, and infrastructure technologies, as shown in Figure 1 of the original paper. In autonomous ships, detection, judgment, and action are performed using AI, and only the action outcome is monitored by crew members or coastal control centers [8]. Situational recognition and detection technology involves a vision system, such as radar, LiDAR, CCTV, and automatic identification system (AIS), that can accurately recognize weather conditions and different objects at sea. Judgment technology allows autonomous ships to automatically sail, berth, and moor based on data collected and predicted using vision systems. It can automatically set a safe, economic navigation route according to sea conditions, predict failures, and take action in advance. Infrastructure technology allows remote control of the ship (in emergencies) from the coastal control center, corresponding to seaport automation technology that can operate autonomous ships, including laws, institutions, and standards.

2.2.1. Situational Recognition and Detection

According to the International Maritime Organization's 1974 SOLAS (Chapter 5, Rule 19 of the 1999/2000 Amendment), installation of AIS is mandatory for most ships except passenger ships weighing less than 300 tons. AIS reports static and dynamic data essential for maritime traffic recognition. Combining AIS data with other data requires high recognition and situational judgment capability, with capable methods including neural networks, Bayesian networks, and Gaussian processes [9]. Additionally, deep-learning-based techniques detecting anomalies in maritime regions using numerous AIS-derived data are being studied, such as variational recurrent neural networks and artificial neural networks (ANNs) [10,11]. A disadvantage of using convolutional neural networks (CNNs) to detect objects at sea is extensive computational work; since this is not always possible in a maritime environment where object size in images varies with distance, the region proposal network (RPN) is proposed as one way to solve this issue, useful when an object's pixel area is very small (e.g., small boats) [12].

2.2.2. Autonomous Navigation System

Autonomous ship operation involves various AI technologies, and the automatic navigation system architecture divides into four technical areas: situational awareness and detection via sensor data collection and analysis for autonomous operation without human decision intervention; judgment technology such as automatic navigation, collision avoidance, and efficient route planning; technology for controlling ship activities and acting on situations based on judgment; and infrastructure technology for operating autonomous ships from outside the ship with remote monitoring and control. Figure 3 of the original paper depicts the autonomous navigation system (ANS) architecture [13]. Most ship collisions are caused by human accidents, a major threat at sea [14]. Ship collision avoidance is regulated by the 1972 Convention on the Prevention of Collisions at Sea (COLREGs). Autonomous ships can avoid collisions with advances in deep learning, by analyzing precollected and real-time sensor data to find actions that can follow COLREGs.

2.2.3. Automatic Berthing System

Berthing is the mooring of ships in ports. Existing large ships are supported by tugboats to help them berth. A tugboat is a marine vessel that pushes or pulls other ships with strong driving force relative to its size. Research was previously conducted on synchronizing movements of several tugboats. Recently, however, research has shifted toward automatically docking ships without additional support vessels such as tugboats. One approach to the berthing problem uses artificial neural networks (ANNs), a statistical learning algorithm inspired by biological neural networks used in machine learning and cognitive science. The ANN-based automated berthing system manually controls the ship to generate training data for neural network training. The ship's status — coordinates, direction, distance to berthing recorded during steering — is used as training data, and the trained network serves as the berthing system's main controller. Existing ANN controllers could only dock at ports where training data was collected, but recent research suggests a controller that automatically docks in new ports without relearning the ANN controller [18–20].

3. Cyberattack Scenarios on Autonomous Ships

From August 2022 to March 2023, 55 maritime cyber incidents were analyzed, with 28 ransomware groups, 19 unknown attack groups, and 8 APT attack groups. Primary damage types are ransomware and service disruption, accounting for more than half of all damage types. Anticipated effects and estimates for autonomous ships do not account for potential cyber and cyber-physical attack threats, because untested combinations of existing maritime systems with new autonomous navigation technologies make comprehensive risk assessment difficult. Attack surfaces (on ships and onshore infrastructure) are increasing, and as they increase, so do potential cyberthreats [24,25]. An autonomous ship's sensors identify position and obstacles from inside and outside the ship and transmit them to the AI model, which analyzes real-time data to determine how the ship can operate stably; as a result of analysis and judgment, the ship navigates under actuator control via the control system. That is, it collects real-time data from sensors such as AIS, GNSS, and cameras and transmits appropriate judgments (based on analysis results) to the navigation or control system to control the ship.

3.1. Ship Dataset Attack

If an attacker attacks vulnerabilities found at the AI learning stage, it can lead to wrong judgments owing to erroneous learning. An anticipated attack scenario is one where a threat is mistaken for a safe element during the voyage and the ship is led to allow access. Jiang et al. [26] used a poisoning attack with particle swarm optimization to inject malicious samples into the training dataset, reducing performance by up to 95–33% in the worst case. Poisoning attacks can thus be attempted on ship identification learning as shown in Figure 5 of the original paper: (a) a normal ship image, (b) the same image with noise added. To the naked eye both are recognizable as the same ship, but when injected into AI training data, classification accuracy can drop significantly [27]. Figure 6 illustrates a possible scenario of a poisoning attack on AI model training data: autonomous ships must crucially learn on the coast where obstacles are many, with the ship system learning the environment — obstacles and fairways — through coastal navigation.

3.2. Sensor Data Attack

Evasion attacks include not only falsifying camera-captured objects but also attacks such as spoofing and jamming exploiting ship system vulnerabilities. Systems can be attacked to malfunction AI through data tampering and disturbance. As shown in Figure 7 of the original paper, if sensor data used as AI input is breached by cyberattack, safe autonomous navigation cannot be guaranteed. For example, AIS is mandatory on many large ships, but the AIS standard does not take security into account [29]. AIS messages are unencrypted and thus at risk of exploitation and manipulation by attackers [30–32]. AIS-vulnerability attacks have been shown possible in scenarios including weather information manipulation, false collision warnings, and denial-of-service attacks [30]. Data tampering and disturbance are expected to significantly impact unmanned autonomous navigation. As described, spoofing, jamming, and DoS are known attacker methods against sensor data. If evasion attacks disturb cameras or cause automated berthing sensor data to miscalculate port distance, the ship may berth at the wrong location or collide with the quay.

3.3. Artificial Neural Network Attack

AI has evolved from classical and reactive methods to machine learning and further to deep learning, an advanced intelligent decision-making algorithm [9]. ANN is the core AI algorithm technology in learning for autonomous navigation. For autonomous vehicles, AI algorithms are based on neural networks such as DNNs, CNNs, and RNNs — advanced ANN forms [37]. As with other software, attacks such as brute forcing, buffer overflow, and malware injection make neural network algorithms insecure [38]. As shown in Figure 9 of the original paper, beyond attacking the AI model dataset, a neural network attack on the AI algorithm process can undermine AI stability. Letting neural networks misperceive and misjudge the real-world environment can be a big problem in safety-critical applications such as autonomous navigation. ANN attacks target automated navigation and berthing systems — key autonomous ship technologies. If the process of taking sensor data as input and deriving output values is compromised, autonomous ships cannot continue normal navigation. Since neural-network-based algorithms are widely used in high-stakes applications, security issues have received widespread attention [39].

3.4. Communication Protocol Attack

Autonomous ship systems can give complete ship control to attackers in cyberattacks owing to high network connectivity for land communication [42,43]. As illustrated in Figure 10 of the original paper, a communication protocol attack targets communications used by autonomous ships. Various protocols are used inside and outside the ship: the Ethernet bus (most common land-based network), 4G/5G wireless networks, and the ModBus protocol (often used in control systems). CAN bus, a message-based protocol widely used in vehicles, is also used. Finally, the NMEA protocol for transmitting and receiving ship sensor data is used. Since in-ship CAN bus and NMEA protocols were not designed with security consideration, the protocols themselves are vulnerable. CAN bus and NMEA communication sends and receives data without encryption or authentication, so if an attacker gains network access, all communication data can be stolen. CAN and NMEA protocols without authentication devices are vulnerable to man-in-the-middle attacks, letting attackers manipulate or collect data in transit between systems.

4. Security Requirements for Autonomous Ships

4.1. Security Requirement Engineering

Security requirements are formulated to achieve security objectives, such as ensuring users and applications are identified and authenticated, only authorized data and services can be accessed, and intrusion attempts by unauthorized users are detected. To achieve these general security goals, 12 security requirements including identification, authentication, and authorization can be formulated [46]. According to Salini et al. [47], security requirements should be considered at an early stage of the SDLC process. The importance of engineering security requirements for software systems is still underestimated; they are analyzed only later in development. To achieve business goals and build a software system protecting information, identifying and specifying security requirements is essential. Thorough security requirements analysis is therefore crucial for software system development, improving development quality and ensuring an available vulnerability-free system. The SQUARE methodology employed in this study is useful for documenting and analyzing field systems' security aspects and supports future improvements and system modifications.

4.2.1. Agreeing on Definitions

The first task is agreeing on a common set of security definitions, defined by considering an organization's security policy and vision. Given differences in expertise and experience between security requirement engineers and stakeholders, any term can carry different definitions among participants, so these perspective differences must be resolved. Ship cyber-resilience (IACS UR E26) and cyber requirements for ship cyber-resilience define terms as shown in Table 1 of the original paper. For example, the attack surface is the set of all possible points where an unauthorized user can access a system and extract data, comprising two categories: digital (all hardware and software connecting to an organization's network — applications, code, ports, servers, websites) and physical (all endpoint devices an attacker can physically access — desktops, hard drives, laptops, mobile phones, removable drives). After finalizing each term's definition, a complete glossary is defined and shared with stakeholders.

4.2.2. Identify Security Goals

Autonomous ships face potential cyberthreats in AI, sensor data, networks, and more, which can allow cyberattacks to succeed. In Section 3 we presented cyberattack scenarios for autonomous ships; through these, five security objectives were established: Integrity (ensure sensor data integrity), Reliability (ensure sensor data reliability), Stability (ensure AI stability), Access control (control the ship network's access), and Availability (ensure autonomous navigation systems' availability).

4.2.3. Develop Artifacts

In the existing ship design process, each design drawing is produced through conceptual, basic, and detailed designs. Here, autonomous navigation systems and components were identified via autonomous-ship case studies rather than the original design process. As shown in Figure 11 of the original paper, the attacker's attack path in network modeling was identified using the earlier-devised autonomous-ship attack scenarios via network logical modeling [49]. Cyber attackers may attempt dataset and neural network attacks in Zones 1 and 2, and sensor data and protocol attacks in Zones 3 and 4. In each attack scenario, vulnerable autonomous-ship attack vectors include AI models, sensors, neural networks, and weak protocols. The Section 3 scenarios are AI model attack methods not occurring on existing ships but possible on autonomous ships. As shown in Figure 12 (autonomous ship attack tree), spoofing attacks on sensor data such as jamming will further increase on autonomous ships due to increased connectivity. Additionally, to replace misuse cases, cyberattack scenarios for autonomous ships were devised as in Table 2 through cyberthreats on ship systems and AI.

4.2.4. Perform Risk Assessments

According to onboard use and application of computer-based systems (IACS UR E22), autonomous navigation systems of autonomous ships can be classified as Category III regarding general system capability classification or malfunction impact degree, with sensors and controllers below Category III classifiable as Category II. In the Figure 12 attack tree, autonomous-ship cyberthreats can be classified accordingly. Referring to the recommendation on incorporating cyber risk management into safety management systems (IACS No. 171), threats were assessed considering their impact on autonomous ships and attacker accessibility. Reflecting IACS UR E22 classification by system capabilities, threats were classified on a 1–3 scale as shown in Table 3 of the original paper, listing potential threats (spoofing, denial of service, jamming, obfuscation, covert channel attacks, steganography, weak encryption, authentication, firmware update, data corruption on systems; poisoning, evasion, inversion, model extraction, buffer overflow, brute forcing, malware injection attacks on AI) against the four attack scenarios.

4.2.5. Select Elicitation Technique

Although SQUARE introduced several suitable derivation techniques, instead of SQUARE's techniques this study used scenario-based requirements analysis to formulate security requirements based on analyzed potential threats and attack scenarios. Scenario-based requirements analysis describes system requirements through scenarios extracted from real-world experience or accessible examples. Among scenario-based requirements analysis methodologies, the SCRAM methodology relies on four techniques [51]: prototype or concept demonstration (core concepts provide reproducible design artifacts); scenario (designed artifacts let users relate their work to the design in the user environment); design rationale (designer reasoning is open to users to encourage participation in decision-making); and requirement priorities identification. Combined with the requirements formulation process, the final method comprises: (1) identification of initial requirements and domain analysis; (2) description of concepts and property setting; (3) derivation and analysis of requirements; (4) validation of requirements.

4.2.6. Elicit Security Requirements

Autonomous-ship potential threats were analyzed to devise various attack scenarios. To formulate security requirements for attack scenarios and security risks, security requirements derivation techniques and other artifacts formulated requirements in terms of what autonomous navigation systems should do: R-01 the sensor's identification-data verification function should be provided; R-02 sensor data transmission must be protected against tampering; R-03 in a denial-of-service attack, minimum ship-operation functions should be provided; R-04 security design must eliminate neural network defects; R-05 an encryption mechanism should protect communication data; R-06 AI must be trained using reliable training data; R-07 unauthorized network connections should be blocked; R-08 protective measures must prevent malware.

4.2.7. Categorize Requirements

Initially formulated requirements are classified, with naming and categorization. Formulated requirements are grouped with a unique group name created to list requirements. Table 5 of the original paper groups requirements into security objectives such as availability, integrity, reliability, stability, and access control: Integrity (R-02 sensor data transmission tamper protection; R-05 encryption mechanism for communication data); Reliability (R-01 sensor identification-data verification; R-04 security design eliminating neural network defects; R-05 encryption); Stability (R-04 security design; R-06 reliable training data; R-08 malware prevention); Access control (R-07 blocking unauthorized connections; R-08 malware prevention); Availability (R-03 minimum ship-operation functions).

4.2.8. Prioritize Requirements

The IACS UR E22 system category classifies systems whose failure immediately threatens humans, ship safety, and the environment as Category III, the highest class, while Category I, the lowest, covers systems whose failure poses no threat. Requirement priority is therefore determined based on high availability. According to E22 system categorization and risk assessment results, requirements are prioritized as shown in Table 6 of the original paper.

4.2.9. Requirements Inspection

Devised requirements were mapped onto IACS requirements as shown in Table 7 of the original paper: High priority (R-02 communication integrity; R-03 denial-of-service protection; R-04 security functionality verification; R-05 communication integrity; R-08 malicious code protection), Medium (R-01 software process and device identification and authentication; R-06 input validation; R-07 network and security configuration settings), Low (R-02). Each IACS UR E27 requirement follows IEC 62443-3-3, describing security requirements for industrial control systems. The mapping confirms the eight derived requirements cover the autonomous-navigation-relevant E27 controls, giving them a strong regulatory foundation.

5. Conclusions

Ship sensor data affects AI perception, judgment, and control, and AI in turn affects ship control. In autonomous ships, individual systems are not independent; each system plays its own role and generates data affecting other systems. Cybersecurity threats can affect not just one system but the entire autonomous ship. Autonomous ships are anticipated to reduce operating costs and maritime accidents, and if an accident is caused by a cyberattack on an autonomous ship, its goals will be hard to achieve. Hardenings such as logical access control, separation of duties, and enhanced account security should be relatively easy to apply. However, if hardening cannot address the problem due to ships' nature, even when a security defect is discovered, great effort and money are necessary for appropriate measures. Therefore, to prevent cyberattacks, each ship system component must be designed so as not to affect other systems during cyber breaches.

In this study, we investigated vulnerabilities and threats in ship systems and AI technologies, and analyzed potential cyberthreats to AI technologies used on autonomous ships. As autonomous ships are still at the research stage, more advanced systems are expected, and security requirements must evolve with them. The study shows that the SQUARE methodology — through its nine steps from agreeing on definitions to requirements inspection — provides a structured, repeatable path for deriving autonomous-ship security requirements grounded in realistic attack scenarios and tied to existing regulatory frameworks such as IACS UR E26/E27 and IEC 62443-3-3.

References

Full reference list (51 sources) available in the original PDF.