On the impact of empirical attack models targeting marine transportation

It is known that 75% of international freight is through maritime transportation. Indeed, as international trade increases, ports face the pressure to improve their infrastructure in order to maintain their operations and respond to market demands. Given such high level of competition, ports ought to leverage their resources efficiently and effectively, which has resulted in increased automation capabilities and the adoption of Cyber-Physical Systems (CPS). For such reasons, the container terminal sector is increasingly becoming susceptible to various types of debilitating threats. While a plethora of research efforts, from both, the control and cyber perspectives have been dedicated to tackling the security of CPS in such sectors, there still exists a significant gap, which is rendered by the lack of properly comprehending and accurately characterizing malicious attackers' capabilities, intents and aims, when targeting such systems. This is largely due to the lack of real malicious empirical data that can be captured, inferred, and analyzed from within the boundaries of such operational CPS realms. Undoubtedly, the goal which endeavors to capture notions of “true maliciousness” in the context of such CPS is significantly challenging, due to many factors, including, (1) the lack of complete maturity and the scarcity of elaborative technical details related to such CPS, (2) the significant diversity of such types of systems, and (3) logistic and privacy constraints which are often strictly enforced by CPS owners and operators. To this end, this paper presents a first step towards inferring tangible notions of maliciousness in the context of maritime transportation. This is accomplished through innovating various mechanisms, namely, investigating passive darknet Internet-scale traffic, instrumenting and analyzing millions of recent CPS malware samples, and deploying tailored, highly-interactive CPS honeypots. Additionally, we analyze the effect of a derived empirical attack, namely, a Distributed Denial of Service (DDoS) attack, using a discrete event simulation in the context of a vessel passing a canal. We postulate that the envisioned derived attack models and their associated impact could be effectively exploited to successfully provide CPS marine transportation security and resiliency.