A modern ship is a floating network — ECDIS talks to the automation system, sensors feed the voyage data recorder, the satellite link bridges to shore. An intrusion on that network isn't a data breach; it's a path to the systems that sail the vessel. The firewalls guard the perimeter; the AI intrusion detection watches the wire itself.
Maritime intrusion detection is the same discipline as shore-side — anomaly detection on traffic — but shaped by what makes a ship different: an OT-heavy network, a unique protocol mix, and attacks whose goal is the vessel, not its data.
Key findings
- The ship's OT/IT network is the attack surface — ECDIS, automation, sensors, satcom all share the wire. Established
- AI intrusion detection watches the traffic pattern — the anomaly in the protocol stream that a signature firewall can't catch. Established
- Maritime protocols are unusual — NMEA, proprietary OT, mixed legacy — which is both a weakness (unfamiliar to defenders) and an asset (distinctive anomalies). Established
- The detection must be onboard — intermittent connectivity means the ship can't rely on a shore SOC watching its wire. Established
- The alert-to-response chain is the hard part — an alert is only useful if there's someone aboard who knows what to do with it. Maritime-GPT analysis
What's on the wire
A ship's internal network is a strange mix — operational technology (engine controls, automation, ECDIS) sharing infrastructure with IT (crew systems, cargo computers, satellite uplink). The attack paths are real: a compromised crew laptop reaches the OT network, a vendor maintenance session opens a bridge, a satellite link terminates inside the plant. The intrusion detector's job is to see the traffic anomaly that reveals the path — the unexpected connection, the unusual command, the flow that shouldn't exist. Established
Why AI, not signatures
Signature-based detection catches known attacks; the ship's threat includes novel ones — a zero-day against the OT, a protocol abuse that hasn't been catalogued. AI anomaly detection watches the network's normal and flags the deviation — it doesn't need to know the attack to see it. The maritime case for AI-IDS is stronger than shore-side because the protocol environment is distinctive: a baseline learned on this ship's traffic makes its anomalies sharper. Established
The onboard requirement
The ship can't outsource its network watch — the satellite link drops, the shore SOC can't see the wire in real time, and the incident that matters may happen mid-ocean. Onboard intrusion detection is the requirement: the model watches the local traffic aboard, alerts the local crew, and logs for shore analysis when the link returns. The detection is shipboard; the investigation can be shore-side — but the seeing has to happen where the wire is. Established
The alert is half the problem
An intrusion alert is only as good as the response it triggers — and aboard a ship, the 'response' is an officer whose job isn't security. The deployment reality is that the AI's alert must be actionable by a non-specialist — 'the engine control system is receiving unusual commands' with a recommended action — rather than a cryptic anomaly score. The shipboard IDS's value is set not by its detection rate but by whether the person it alerts can do something about it. Maritime-GPT analysis
What we know
- The ship's OT network is attackable and safety-relevant.
- AI anomaly detection catches novel attacks that signatures miss.
- Detection must be onboard — the ship can't rely on a shore SOC.
What we don't
- False-positive rates for maritime OT anomaly detection in practice.
- How shipboard alerts integrate with crew workflows.
- Whether maritime-specific IDS training data exists at scale.
Being tested
- Onboard IDS deployments on live OT networks.
- Maritime-protocol-aware anomaly detection.
- Alert-to-action interfaces for non-specialist crew.
Maritime-GPT analysis
Intrusion detection on a ship is the safety case's quiet layer — the network that runs the vessel needs a watchkeeper, and a signature firewall is a lookout who only recognizes ships he's seen before. The AI-IDS watches for the anomaly itself. Its honest constraint is the response: an alert that the crew can't act on is just noise, so the real engineering is the actionable-alert design as much as the detection model. Maritime-GPT analysis
This is a research feature, not operational guidance. Simulation results are reported as simulation; demonstrations are not deployments; company claims are attributed as such. Verify safety-critical decisions against official nautical publications and flag-state requirements.
Sources & evidence
The resilience baseline that includes detection capability.