Survey and Future Trends for Cybersecurity in Maritime and Port Sectors: A Discrete Event Systems Perspective

Abstract

With the development and widespread application of information technology, cybersecurity has become a focal point in all industry sectors. The maritime sector is no exception, with both physical and cyber threats. This survey first highlights, from a system engineering and information technology perspective, the specific architectures of on-vessel and in-port systems, as well as the communication equipment connecting them. Subsequently, cyber attacks in maritime and port domains and their potential consequences are described from various angles. Examples of real cases of cyber attacks are also reported. An overview of current key techniques used in vulnerability analysis, attack detection, and security protection is proposed before discussing cybersecurity issues in the maritime and port sectors from the particular perspective of discrete event systems. Various systems used in maritime and port domains are modeled as automata or Petri nets. Some analysis, detection, and protection approaches are then proposed to illustrate the potential of discrete event systems in this domain.

1. Introduction

According to the UNCTAD Review of Maritime Transport 2024, maritime transport handles over 80% of world trade volume, making the maritime industry a critical factor in the world economy. It relies on an extensive global network of ports and shipping lanes. As the industry undergoes digital transformation, innovations such as smart shipping, automated ports, and blockchain offer efficiency and cost opportunities: connected navigational, communication, cargo management, dynamic positioning, terminal management, tracking and logistics systems make operations more efficient — but this growing digitalization and connectivity also introduce substantial cybersecurity challenges. To address them, the industry must focus on vulnerability analysis, improved attack detection, and resilient defense strategies.

System security prioritizes the confidentiality, integrity and availability (CIA) triad: confidentiality restricts information to authorized parties; integrity protects data from unauthorized alteration while maintaining accuracy and trustworthiness; availability guarantees authorized access whenever needed. System vulnerabilities — weaknesses in design, implementation or configuration exploitable for unauthorized access, disruption or harm — threaten this triad. Vulnerability analysis in maritime and port sectors means systematically identifying, assessing and addressing weaknesses across connected devices, communication networks, information systems and operational technologies, through: identifying vulnerabilities, assessing risk impact on CIA, prioritizing by severity and likelihood, mitigation and protection (patch management, intrusion detection, network segmentation), and continuous monitoring against evolving threats. The survey's literature was identified through targeted searches in Scopus, Web of Science, IEEE Xplore and SpringerLink (2005–2025) combining 'discrete event system', 'cybersecurity', 'cyber attack', 'maritime' and 'port', refined to works with conceptual, methodological or representative applied contributions.

This survey distinguishes itself from previous reviews by focusing specifically on maritime and port sectors from a system engineering and IT perspective, using discrete event system (DES) models — aimed at professionals, researchers and decision-makers in maritime operations, port management and DES methodologies. Section 2 describes the maritime and port equipment and sites where cyber attacks are likely, given information transmission and exchange. Section 3 covers cyber attacks and cybersecurity: attack classification with examples, common vulnerabilities, consequences, and analysis tools. Section 4 studies maritime and port cybersecurity from a DES perspective, modeling vessel traffic management, radar and port automated guided vehicle systems with automata and Petri nets. Section 5 explores DES-based analysis, detection and protection. Section 6 outlines main research challenges and future directions; Section 7 concludes.

2. Architectures of On-Vessel and In-Port Communication Systems

On-vessel systems

Researching maritime cybersecurity requires thoroughly understanding ship–port communication structures — ship-to-ship, ship-to-port and port-to-port — since their interconnection creates cyber risk. Maritime infrastructure comprises two platforms: on-vessel and in-port. On-vessel systems include: navigation systems critical for safe navigation (radar, GPS, AIS, ECDIS, echo sounder); communication systems for contact with ports, vessels and authorities (VHF radio, satellite communication, MF/HF radio); control systems for precise maneuvering and stability when entering or leaving ports (autopilot, propulsion control, ballast water systems); and identification systems (AIS, ship lights, horns) for visual and electronic vessel identification.

In-port systems and ship–port communications

In-port systems include: the port control center overseeing vessel movements and berth assignments; vessel traffic service monitoring and guiding movements with navigation assistance and collision prevention; berthing facilities (mooring buoys, bollards) for safe docking; port communication systems (VHF radio, telephone, email) coordinating with ships and stakeholders; and port security systems (CCTV surveillance, access control). Ship–port communications comprise: berthing/departure notification (estimated arrival times, berth assignment requests and confirmations); berthing operations (continuous VTS communication during approach and departure — docking instructions, tugboat assistance, operational details); and emergency communication (VHF, GMDSS) for assistance or incident reporting. Together these structures ensure smooth, safe operations from navigation to docking, communication and security.

3.1. Main Types of Cyber Attacks

AIS, navigation and communication systems

AIS has been mandatory since 2002 for passenger and sea-going vessels of 300 gross tonnage or more, serving vessel safety, collision avoidance and ship monitoring with course, speed and position data. But AIS lacks built-in security measures: exposure through connectivity and information providers creates high operational risk, and AIS can be deactivated or manipulated to create false collision or search-and-rescue alerts. Documented cases include the 2017 Black Sea mass GPS spoofing (ships showing on-land or false positions, including HMS Defender near Crimea), and 2019–2020 'phantom fleets' in the South China Sea and off South America masking illegal fishing or sanctioned oil movements. Navigation systems face false-signal attacks overlapping true positions or fake emergencies — amplified by reliance on dynamic positioning, ship-to-shore interfaces, propulsion controls, cargo valve actuators and passenger-boarding systems. Cases include the 2013 University of Texas yacht GPS-spoofing takeover, 2014/2017 Russian-attributed spoofing, the 2016 return-to-radio navigation debate, and the February 2017 multi-hour takeover of a German 8,250 TEU container vessel's navigation en route from Cyprus to Djibouti. Vessel communication, shipping company and cargo loading/unloading systems are likewise targeted through manipulation, sabotage, falsification, piracy, robbery, destruction, alteration and deviation.

Malware, phishing, DDoS, MITM, credential theft and supply chain

Table 1 catalogues eight attack types with real cases. Malware (ransomware, viruses, worms) disrupts operations, steals data or causes damage — e.g. the 2017 NotPetya ransomware attack on Maersk crippling IT systems and disrupting 76 ports worldwide. Phishing tricks employees into revealing credentials or downloading malware — e.g. the 2020 MSC attack via a malicious link in a seemingly legitimate email. Distributed Denial of Service (DDoS) overloads port or company servers — e.g. the 2024 attack on Belgium's Port of Antwerp disrupting operators' systems and communications. Man-in-the-Middle (MITM) intercepts and alters ship–port or in-port communications — e.g. the 2019 attack on an Iranian port producing wrong docking instructions, delays and cargo mishandling. Credential theft via phishing, brute force or social engineering enables system manipulation — e.g. the 2020 Danish shipping company breach altering schedules. Supply chain attacks compromise third-party suppliers — e.g. the 2020 compromise of a navigation software supplier to several U.S. shipping companies, implanting malicious code in an update that disrupted multiple vessels' navigation.

GPS spoofing and advanced persistent threats

GPS/GNSS and AIS spoofing sends false signals misleading ships about their true location, causing navigation errors, collisions or grounding — e.g. the 2017 Black Sea GPS anomalies believed to be targeted spoofing disrupting area traffic. Advanced Persistent Threats (APTs) are long-term state-sponsored stealth operations gathering intelligence or causing disruption with severe national-security, infrastructure and financial consequences — e.g. the 2020 state-sponsored attack paralyzing several Iranian ports with massive cargo backlogs. These events represent only the tip of the iceberg, with many similar unreported incidents. Beyond these, the paper recalls foundational notions: a cyber incident as an occurrence with actual or potential adverse consequences for onboard systems, networks, computers or their data (per BIMCO guidelines); a cyber attack as any offensive maneuver against IT/OT systems, networks or personal devices to compromise, destroy or access company and ship systems and data; plus CIA definitions framing the analysis.

3.2. Literature Review on Cybersecurity in Maritime and Port Sectors

With three decades of advances in communications, networked systems and cyber–physical devices, cybersecurity has become critical across domains, and survey publications on maritime and port cybersecurity have grown exponentially (statistics from ResearchGate, MDPI, Elsevier and Cambridge are charted). Tables 2 and 3 summarize the considered survey papers. Recent surveys (2024–2025) cover: port resilience as fragmented research needing empirical studies; MASS cybersecurity threats and defenses with AIS/GPS vulnerabilities and IMO-integrated multi-layer protections, AI, blockchain and behavior analytics; blockchain in maritime logistics (transparency and traceability versus standardization, scalability, regulatory and IoT/AI integration challenges); comprehensive maritime cybersecurity across vessels, ports and supply chains; and 2011–2023 port cyber attacks (15 cases: ransomware and disruption dominant, weak procedures and low awareness as risk amplifiers, timely detection, collaboration and disaster plans as resilience keys).

Earlier surveys (2008–2023) span: cyber-seaworthiness as a policy concept for digitization and autonomous ships; maritime threat gaps (no real-time attack data, limited economic studies, inadequate training, insufficient legal frameworks); mostly conceptual/qualitative literature calling for quantitative and interdisciplinary work; IoT-enabled maritime threats and protection limits; descriptive challenge mappings needing empirical action; bibliometric digital-transformation risk analyses urging policy, technology and training defenses; systemic governance approaches; ship information-security risk reviews with multilayer resilience; regional IMO/Europe/Asia cooperation analyses; Internet-of-Ships architectures; maritime innovation reviews; 2019 maritime cybersecurity incident/threat reviews (poor training, outdated IT, hacker targeting) with process, upgrade and culture countermeasures; maritime risk evaluations; 'wicked problem' framings of ship attacks demanding holistic adaptive approaches; risk-analysis models and algorithms; industry unpreparedness warnings especially for autonomous vessels; risk assessment approaches; safety-critical infrastructure resilience; the foundational 'Threats and impacts in maritime cyber security' study; the McNicholas maritime security textbook; cyber-resilience challenges (awareness, regulation, preparedness, collaboration, adaptive defense); and port/maritime security research perspectives with risk-based shipping models.

3.3. Consequences and Mitigation Guidelines

Cyber attacks in maritime and port sectors have extensive, severe safety, environmental and economic impacts. Safety: compromised navigation, communication and cargo systems can leave vessels out of control, misnavigated or colliding, endangering crew and passengers — the 2017 NotPetya attack on Maersk crippled IT and scheduling across the global shipping network, exposing grave safety risks even without direct collisions. Environmental: attackers controlling navigation or control systems can ground vessels or cause collisions in sensitive areas, spilling oil or chemicals — the 2010 Stuxnet worm, though aimed at nuclear facilities, demonstrated the scale of damage possible if similar attacks hit vessels carrying hazardous chemicals in fragile marine ecosystems. Economic: ports and shipping companies are critical trade nodes where attacks cause cargo delays, supply-chain disruption and heavy financial losses plus restoration costs — the 2020 CMA CGM ransomware attack blocked online booking and severely interrupted logistics, harming both the company and global supply-chain stability.

In summary, safety hazards, environmental risks and economic losses are the primary impact dimensions. Mitigation demands stronger defenses, robust incident response plans, and continuous monitoring and updating. Key authoritative guidelines (technical-procedure-light, action-driving) include: IMO Guidelines on Maritime Cyber Risk Management, integrated into the ISM Code requiring cyber risk in safety management systems; International Maritime Bureau (IMB) best management practices against piracy and maritime cyber risks; BIMCO Guidelines on Cyber Security Onboard Ships with detailed owner/operator implementation recommendations; International Maritime Satellite Organization (IMSO) guidelines securing global maritime communication systems and networks; European Maritime Safety Agency (EMSA) port-cybersecurity guidelines protecting facilities and operations; and the US Coast Guard cybersecurity framework profile for maritime based on the NIST framework.

3.4. Vulnerability and Analysis Tools

In cybersecurity, 'vulnerability' has two meanings: a system weakness or flaw an attacker may exploit (from software errors, outdated software, weak protocols), and the overall susceptibility or fragility of a system to attacks — an evaluation of exposure to existing threats, where any flaw breachable for integrity, availability or confidentiality counts. This paper uses mainly the second meaning: weaknesses leveraged for unauthorized actions, e.g. accessing data without credentials, with attackers typically exploiting one flaw for a foothold then moving laterally to the target. The maritime industry suffers characteristic vulnerabilities: outdated unsupported IT/OT systems on obsolete platforms; OT systems unpatchable or incompatible with antivirus due to type-approval constraints; diffuse responsibility across ship-operation and chartering stakeholders; online interfaces with onshore parties and supply-chain components; remotely monitored/accessed equipment (manufacturers, service providers); business-critical and commercially sensitive data shared with shore entities (terminals, stevedores, authorities); unpatched or inadequately secured computer-controlled critical systems affecting safety and environment; improvable cyber-risk culture (training, roles); and shipyards assembling subsystems with minimal cyber-risk attention.

System fragility is analyzed along three dimensions: likelihood/ease of compromise (including susceptibility to specific attack types, success likelihood, or intruder time-to-compromise); detection-strategy performance (how effectively and quickly intrusions are identified — efficient detection greatly reduces impact); and successful-attack impact (resilience and per-attack-type consequences). Vulnerability sequences model as state changes transferring the system from secure to attacked states; network topology is graph-structured, making graphical tools the best modeling choice — attack graphs, attack trees, and cyber kill chains. Cyber kill chains describe an attack as ordered-duration steps (reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives). Attack graphs/paths (Swiler et al. 1998) visually display possible attack sequences from information-flow, topology and vulnerability analysis: nodes are hosts, vulnerabilities or devices; edges are privilege-gaining evolutions — valuable for complex interconnected maritime/port systems. Attack trees (Schneier) display successive intruder steps toward a goal: the root is the objective, intermediate nodes sub-goals, leaves atomic actions, combined conjunctively, disjunctively, or in conjunctive-sequential order.

4.1. Vessel Traffic Management System

A Vessel Traffic Service (VTS) is the authority controlling vessel traffic, supported by the computerized Vessel Traffic Management System (VTMS) that helps port authorities dock, undock and operate vessels. The VTMS assists in managing vessel movements for safe, efficient, orderly flow: monitoring positions, coordinating arrivals and departures. For simplicity the single-vessel case is modeled: the process starts idle awaiting a vessel; upon neighborhood arrival, communication monitors location and confirms identification for admission; once verified, a dock is assigned; the vessel may wait if the dock is occupied; when free it moves in under VTMS guidance; after docking, cargo loading/unloading begins; on completion VTMS assigns departure time with exit navigation instructions; the vessel leaves along its route until exiting the neighborhood, and the system resets to idle. This VTMS faces attacks such as fake vessel injection, where an attacker introduces a fictitious vessel appearing legitimately in the neighborhood.

The normal VTMS process and the attack scenario are modeled with Labeled Timed Probabilistic Automata (LTPA): a 6-tuple G = (S, E, Q, Obs, delta, Pi(0)) of finite states, observable/unobservable events, observable labels, a labeling function, timed transitions with rates, and initial-state probabilities. The paper instantiates VTMS with 13 states (s0 idle through s8 vessel leaving, plus attack states s0' idle-attack, s1' fake vessel approaching, s2' fake authentication, s8' fake leaving), observable/unobservable events, an 11-label alphabet, the Obs labeling function, the full transition relation, and initial distribution concentrated on s0. The fake-vessel-injection attack pattern is a two-state automaton (Normal, Attack) transitioning to Attack exactly on the silent attack event es0,s0'. Stochastic Petri nets are noted as an alternative for modeling and analyzing systems subject to attacks, failures or unpredictable events.

4.2. Radar System

Commercial vessels — container ships, bulk carriers, tankers — depend on radar to detect surrounding targets, avoid collisions and optimize paths, requiring real-time awareness of nearby environmental conditions and other vessels' positions and headings, plus close inter-vessel collaboration. Radar is thus the core sensing technology: vessels emit signals bouncing off ships, coastlines or rocks, estimating distance from travel time and relative speed via Doppler effect. Given automata's simplicity for behavior description, the paper models radar information exchange with a four-vessel squadron: Vessel A (north) detects and gathers information initiating communication; Vessel B (east) monitors routes and watches for obstacles; Vessel C (south) supports and coordinates communication and logistics; Vessel D (west) detects hazards and responds to emergencies. VA emits signals; VB, VC, VD receive and relay positions/headings back; VA adjusts course then passes the priority token sequentially (VA→VB→VC→VD→VA); each vessel adjusts, emits updated signals, and ultimately all avoid collisions. The automaton G = {Q, E, delta, q0} has 8 states (all-standby through each vessel's course correction), 8 events, initial state 0, with transitions like delta(1, e1) = 2.

Attackers can compromise the system by manipulating, deleting or substituting signals — i.e. system events. An example attack plan tabulates, per generated event (including empty event epsilon), the corruption: '(e2, e3)' means generated e2 replaceable by e3; 'delete e5' means e5 replaceable by epsilon; 'insert e7' means inserting e7. Under this DES attack formulation, a modified automaton built over the attack events determines whether the system is under attack. The VTMS, radar and AGV examples together illustrate how automata and Petri nets model maritime communication systems and sensor networks.

4.3. Port Automated Guided Vehicles System

Consider a port system with five loading areas Z1–Z5 (warehouses, storage yards, docks) as the hub for cargo loading, unloading, transshipment and storage across transportation modes. Several automated guided vehicles (AGVs) wait to enter, move between areas transporting cargo or delivering goods to trucks or vessels, entering each area, picking up and dropping off goods, and exiting through designated quay interfaces via entry points. A labeled Petri net models vehicle movements: places p1–p5 correspond to areas Z1–Z5, each transition firing represents one vehicle transiting the respective quay interface, detected by interface sensors, with letters q1–q8 as sensor labels.

5.1. Security Metrics

Metrics measure security policy, mechanism and implementation effectiveness, identify vulnerabilities, prioritize corrective measures, and raise awareness. Widely used graph-based metrics: shortest path (least attacker effort from initial to target state); number of paths (more routes = lower security, more attacker opportunities); mean path length (average exploits needed to reach target); mean time to security failure (expected time to first successful compromise); steady-state security (long-run security level as time approaches infinity); and type of security failure (probability of each attack path being selected across privilege levels). In vulnerability analysis for DES, three tool families model system–attack interactions: attack and defense graphs, attack and defense trees, and cyber kill chains, alongside models combining baseline behavior with attack scenarios. Analytical methods include logic-based approaches (graph algorithms, kill chain, cost algorithms) and probabilistic extensions — Bayesian networks and Markov models — providing quantitative assessment with strong maritime potential for identifying vessel/port weaknesses toward more resilient, secure systems. (The assessment of these metrics depends on the proposed approach and model; detailed approaches and examples are referenced.)

5.2. Cybersecurity in Discrete Event Systems

Recent networked-DES cyberattack research addresses how vulnerabilities in networked control frameworks are exploited and protected, around vulnerability analysis, attack detection, and mitigation/defense (tabulated across the literature). Contributions separate by main objective (analysis, detection, mitigation); under 25% directly concern maritime/port domains, but most extend readily to those sectors. Most use automata or Petri net tools; some add Bayesian, Markov or other probabilistic models for vulnerability. Key efforts: vulnerability modeling and analysis (weak points in DES communication networks and control logics exploitable for data manipulation, denial of service, false data injection); attack detection (machine learning, anomaly detection algorithms, real-time monitoring swiftly responding to abnormal event-driven patterns); and attack mitigation/defense (resilient networked DES architectures with robust fault-tolerant control, encryption, secure communication protocols withstanding attacks and reducing impact) — essential for maritime logistics, smart grids and autonomous transportation.

5.3. Performance Evaluation with Markov Models and Probabilistic Automata

A security threat is a stochastic process modelable as a Markov chain: state-to-state transition probabilities derive from next-state vulnerabilities, each chain path is an attack path to breach, and each path is a state sequence. The paper adapts fault-detection-function (FDD) performance evaluation: an FDD is a complete deterministic finite automaton FDD = (A, Q, deltaD, A0bar, A) over FDD states, observable labels and transitions, with non-alarm states and one stable alarm state, deciding from observations whether the system is faulty. Studied performance covers non-detection (faulty mode, no alarm), false alarm (alarm in normal mode), and detection delay (lag between fault transition and alarm) — three quantitative metrics via long-run Markovian approximation, developed for diagnosis but extensible to Attack Detection Functions (ADF): a fault pattern automaton FP = (N, E, deltap, N0, Att) with normal states plus one stable pattern-occurrence state.

A concrete ADF detects fake vessel injection for the Figure 3 VTMS under the Figure 4 attack pattern: states A = {A0bar, A1bar, A2bar, A}, system-label events, transitions looping on non-a/b/k labels and advancing (A0bar, a)→A1bar→(b)→A2bar→(k)→A (alarm), alarming on observed sequence 'abk'. Applying the Markovian approach, this ADF's fake-vessel-injection detection evaluates to a 99% false alarm rate, 0% non-detection rate, and three-time-unit average detection delay — via two successive compositions: system model with fault pattern, then the result with the ADF.

5.4. Security Enforcement with Petri Nets

For the AGV port system, excessive vehicle concentration in one loading area causes congestion, cargo-handling delays, scheduling disruption, efficiency loss, economic loss, and collision risk. Each area therefore needs a capacity set by control constraints reflecting berth scheduling, vessel turnaround times and logistics dynamics — not merely physical space. Example: AGV area Z4 (a container terminal berth) with capacity three, formalized as generalized mutual exclusion constraint (GMEC) J = ([0,0,0,0,1,0,0]^T, 3), restricting the token (vehicle) count in p5 to three. Now suppose sensor deception vulnerability: an attacker alters observations of a Z4-entering vehicle to appear as Z2-entering — i.e. after label q5 (transition t7 or t6 fires), the observation becomes q2: R = {(q5, q2)}. Firing sigma = t14t22t5t6t32t7 from the initial marking reaches M = 2p3 + 2p4 (two vehicles each in Z3, Z4); if t7 fires at M (Z3→Z4 move), the system reaches M' = p4 + 3p5 with sensor label q5 — but under attack (q5→q2) authorities believe Z4 holds only two vehicles, potentially admitting another AGV via t6/t7 and exceeding capacity three.

Supervisory control theory for DES offers the solution: design a supervisor guiding or restricting system evolution so supervised behavior meets control specifications, typically by disabling events based on observed output — observing events via sensor readings and issuing control commands to actuators. Per the cited online supervisory control policy, the algorithm initializes observation and forbidden-transition sets, then on each observed label q updates the observation, computes zeta(omega) = 3 − (pi_omega(q5) + pi_omega(q2)) + pi_omega(q4) + pi_omega(q6) from label occurrence counts, and disables transitions whose label counts exceed max{0, zeta(omega)}. The acquired supervisor dynamically guides AGV behavior under these control rules, preventing Z4 overconcentration despite vulnerability to sensor deception attacks R = {(q5, q2)}.

6. Open Problems and Future Directions

As maritime and port sectors digitally transform, supporting cyber–physical infrastructures grow more complex, interconnected and vulnerable to sophisticated threats. While DES methodologies show strong modeling, detection and control potential, fundamental challenges remain. Data availability and dataset generation: a recurrent industrial-cybersecurity research problem is missing data — vessel complexity and heterogeneity hinder adapted datasets, and confidentiality blocks public sharing. Three solutions exist: open datasets (the Admiral database listing maritime-sector attacks, though mostly without technical detail; accessible AIS data via AIS-hub and MarineTraffic); laboratory datasets from controlled learning platforms simulating anomalies and attacks on specific systems; and simulation-generated datasets, since ships embed general industrial systems modelable with general tools under maritime constraints (e.g. water distribution systems). Still, the lack of standardized high-quality datasets impedes empirical validation and benchmarking — future work must develop shared maritime cybersecurity datasets and testbeds for reproducible, comparable experiments.

Modeling and system complexity: future research must address growing ship-operation complexity, multi-agent collaboration and advanced threat management from cyber–physical and networked perspectives. More sophisticated sensor- and AI-equipped vessels demand enhanced formal and numerical models for dynamic real-time decision-making under uncertainty at scale — e.g. probabilistic and timed automata capturing environmental uncertainties (weather, hazards) and navigation/communication temporal aspects; scalable hybrid and discrete-event frameworks for larger-fleet collaborative optimization, coordination and resource allocation; and DES models accounting for coordinated multi-vector and AI-driven adversarial attack strategies. Comparative modeling approaches: a needed direction is comparing DES-based formal methods with traditional techniques (Bayesian networks, Markov models) for relative strengths in modeling cyber–physical security in maritime/port settings. Currently little evidence applies Bayesian or Markov formalisms specifically to maritime/port cybersecurity — existing works address high-level risk reasoning (Mohsendokht et al. risk-factor dependencies; John et al. seaport resilience), MASS risk prediction (Aydin et al. Z-number Bayesian network), floodgate attack/accident distinction, educational ship-cybersecurity Markov chains, intent classification HMMs, or AIS anomaly reviews — differing in scope from port IT/OT attack–defense dynamics. Missing shared datasets, standardized protocols and consistent model setups currently prevent rigorous like-for-like comparison; establishing benchmarks and DES–probabilistic hybrid approaches are open challenges.

Adaptive and distributed supervisory control: future mechanisms must dynamically reconfigure against attacks on key port operations (quay-side activities, berth management, container terminal automation), enabling rapid adjustments to vessel scheduling, cargo handling and AGV management for efficient resource allocation across berth zones, quay interfaces and storage — supervisory control efficiently prevents decisions driving the system into vulnerability, and capacity limits build resilience; advanced schemes integrating decisions and operations enforcement are needed for full cybersecurity support. Software tools: no numerical/software tool exists based solely on DES for vulnerability analysis, attack detection and security protection in maritime/port computer systems and networks — though general IT/OT tools apply (Tenable.ot, Nessus, OpenVAS, Greenbone for assessment; Zeek, Suricata, Snort, Nozomi Guardian, Clarity, Dragos for monitoring/intrusion detection; Elastic Security, Splunk, IBM QRadar, Wazuh, OSSEC for integrated security management), plus MITRE ATT&CK (adversary behavior taxonomy) and MITRE D3FEND (defensive countermeasure mapping, covering modern attacks' multidimensional nature) — to be combined with DES models in future implementation and validation. Integration of AI and blockchain: decentralized blockchain authentication/access control creates distributed identity systems for safe port data sharing (smart contracts, encryption against unauthorized access/leakage), supply-chain transparency and traceability preventing forgery (secure logistics tracking), while AI (machine/deep learning, anomaly detection) identifies abnormal behaviors, predicts threats and optimizes real-time response — and with DES control theory enables dynamic decision-making, state estimation and adaptive control under uncertainty/adversity, with blockchain as an immutable trust layer recording DES events, control decisions and transitions for traceability, accountability and resilience: a promising autonomous, transparent, verifiable cybersecurity architecture for maritime/port environments.

7. Conclusions

The increasing integration of connected and automated systems in maritime and port sectors has greatly improved operational efficiency but also introduced significant cybersecurity challenges. As digitalization expands, vulnerabilities across OT and IT layers become more critical, requiring continuous assessment, rapid detection, and effective protection mechanisms. This survey emphasized the potential of DES modeling as a formal and systematic approach for analyzing, detecting, and mitigating cybersecurity issues in maritime and port domains. DES-based methods enable structured representation and proactive defense design for complex event-driven systems.

Future research should address current limitations such as data availability, standardization, and tool interoperability while exploring integration with emerging technologies like AI, digital twins, and blockchain. Advancing these directions will help build more adaptive and resilient frameworks to secure next-generation smart ports.