A study on fleet security monitoring framework based on maritime cyber incident response

This study proposes a fleet-level integrated cyber security monitoring framework to address the maritime industry’s digital transformation and rising cyber threats. By analyzing incidents from 2010–2020, security requirements tailored to ship operations were derived, leading to a framework that links onboard infrastructure with shore-based security operations centers for real-time monitoring and remote response. The framework enhances threat visibility and response across fleets of multiple vessels. Validation using a ransomware scenario confirmed complete detection of threat events and remote response within an average of 2 minutes and 11 seconds. Usability and system stability evaluations further demonstrated applicability in operational environments. These findings verify the feasibility of effective fleet-level monitoring and highlight contributions to cyber resilience and incident response strategies. Future scalability may be achieved through AI-driven threat severity assessment and adaptive policy management, ensuring sustainability and adaptability in evolving maritime contexts.